BGP Established but can't ping

[HS08]

My fortigate hub have BGP connection to the spoke, the spoke ip is 10.10.112.11 and BGP was established.

But why i can't ping to that spoke bgp peer ip? So traffic from the hub can't reach the spoke using this tunnel interface

If i ping 10.10.112.1 from spoke to the hub the result is reply.

[HS08]

hi @dingjerry_FTNT , @funkylicious 

There is no ICMP on the spoke, only psh and ack

[Toshi_Esumi]

What do you see if you have two CLI sessions, running this sniffing in one session and ping toward 10.10.112.1 in another? You said that direction worked.

Toshi

[HS08]

did you mean running the sniff in hub then do ping from spoke to 10.10.112.1?

[Toshi_Esumi]

on the spoke side since you couldn't see any ping packets from the HUB. At least you should see at the spoke ping packets toward the HUB go into  the tunnel and ping replies should come back from the tunnel.

Also if you patiently keep sniffing on the spoke side you should see BGP/TCP 179 traffic as well since you said BGP was up. It might show up every 30 sec or so though.

Toshi

[Toshi_Esumi]

Actually the TCP 179 traffic is there above screenshot. So BGP has been working as you said.

Toshi

[Toshi_Esumi]

But the local IP in the sniff result is 10.10.112.6. Not 10.10.112.11. Are you sure you were sniffing at the correct spoke location that has 10.10.112.11?

[HS08]

hub and spoke have 2 internet connection so there will be 4 tunnels.

The topology is

spoke tun1  (internet 1) 10.10.111.6 <--------------------> 10.10.111.1 hub internet 1

spoke tun2  (internet 2) 10.10.111.11 <--------------------> 10.10.111.1 hub internet 1

spoke tun3  (internet 1) 10.10.112.6 <--------------------> 10.10.112.1 hub internet 2

spoke tun4  (internet 2) 10.10.112.11 <--------------------> 10.10.112.1 hub internet 2

Tunnel connection from hub internet1 (10.10.111.1) is working fine to tun1 and tun2 but not for hub internet2 (10.10.112.1) to tun3 and tun4.

Ping from hub to 10.10.112.6 or 10.10.112.11 was not successful.

[HS08]

yes, but the traffic from the hub can't reach the spoke if passing thru this tunnel even BGP was established.

[HS08]

Yes true, sniffing in the spoke there is no icmp request sent from hub and I can see TCP/179. For that reason the BGP was established.

[Toshi_Esumi]

Did you see ping replies from the tunnel when you pinged from the spoke toward the hub?

So now you're saying you have four tunnels (I think the first time you mentioned through all your previous posts). I'm almost sure it would screw up ADVPN. Because ADVPN is supposed to need only one manual IPsec configured between one hub and one spoke. Then ADVPN itself sets up spokes to spokes automatically.

You have two iBGP peerings between this pairing:the hub and this spoke, right? Since FGT's BGP wouldn't allow two neighbors with the same IP address.
What do you have in "get router info bgp sum"?

It would look like below:

fg40f-utm (root) # get router info bgp sum

<snip>

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/Pf xRcd
10.x.x.121 4 65528 43756 43464 2 0 0 03w2d00h 521
10.y.y.253 4 65528 0 0 0 0 0 never Idle (Ad min)    <- my second IPsec is Admin down

Total number of neighbors 2

Toshi