Can't ping VLAN interfaces through VPN

[jnapier4]

Hello - I have 5 vlans configured on my FGT 60F. I am using SSL VPN. I have left the internal physical IP at 192.168.1.99. My VLAN interfaces are 10.235.20.1, ...30.1, ...40.1, ...60.1 and ...100.1.

I created a policy for inter-vlan routing. When I connect directly to my FGT, I can ping all VLAN interfaces and the physical interface. All good.

When I connect with Forticlient,  I can ping the internal 192.168.1.99 phyiscal IP but I cannot ping any of the VLAN interfaces. I have nothing connected to the VLANs but I would have assumed I'd be able to ping the interfaces, especially since it's successful when I'm directly connected to the FGT. See below. Any thoughts?

Thanks,

Joel

[AEK]

Hi @jnapier4 

Please enter the following commands in FG CLI, then try ping the VLAN interface from VPN client.

diag debug flow filter addr <VPN-Client-IP>
diag debug flow filter proto 1
diag debug flow show function-name enable
diag debug flow show iprope enable
diag debug console timestamp enable
diag debug flow trace start 10
diag debug enable

Please share the output once done.

[jnapier4]

Here you go...

FortiGate-60F # 2024-04-27 12:39:57 id=20085 trace_id=1 func=print_pkt_detail line=5822 msg="vd-root:0 received a packet(proto=1, 172.16.0.50:1->10.235.30.1:2048) from ssl.root. type=8, code=0, id=1, seq=24."
2024-04-27 12:39:57 id=20085 trace_id=1 func=init_ip_session_common line=5993 msg="allocate a new session-0001e67c"
2024-04-27 12:39:57 id=20085 trace_id=1 func=iprope_dnat_check line=5121 msg="in-[ssl.root], out-[]"
2024-04-27 12:39:57 id=20085 trace_id=1 func=iprope_dnat_tree_check line=823 msg="len=0"
2024-04-27 12:39:57 id=20085 trace_id=1 func=iprope_dnat_check line=5134 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
2024-04-27 12:39:57 id=20085 trace_id=1 func=vf_ip_route_input_common line=2615 msg="find a route: flag=84000000 gw-10.235.30.1 via root"
2024-04-27 12:39:57 id=20085 trace_id=1 func=iprope_fwd_check line=765 msg="in-[ssl.root], out-[VLAN30], skb_flags-02000000, vid-0, app_id: 0, url_cat_id: 0"
2024-04-27 12:39:57 id=20085 trace_id=1 func=__iprope_tree_check line=557 msg="gnum-100004, use addr/intf hash, len=2"
2024-04-27 12:39:57 id=20085 trace_id=1 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-3, ret-no-match, act-accept"
2024-04-27 12:39:57 id=20085 trace_id=1 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-0, ret-matched, act-accept"
2024-04-27 12:39:57 id=20085 trace_id=1 func=__iprope_user_identity_check line=1777 msg="ret-matched"
2024-04-27 12:39:57 id=20085 trace_id=1 func=__iprope_check_one_policy line=2174 msg="policy-0 is matched, act-drop"
2024-04-27 12:39:57 id=20085 trace_id=1 func=iprope_fwd_check line=806 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-drop, idx-0"
2024-04-27 12:39:57 id=20085 trace_id=1 func=fw_local_in_handler line=447 msg="iprope_in_check() check failed on policy 0, drop"
2024-04-27 12:40:02 id=20085 trace_id=2 func=print_pkt_detail line=5822 msg="vd-root:0 received a packet(proto=1, 172.16.0.50:1->10.235.30.1:2048) from ssl.root. type=8, code=0, id=1, seq=25."
2024-04-27 12:40:02 id=20085 trace_id=2 func=init_ip_session_common line=5993 msg="allocate a new session-0001e696"
2024-04-27 12:40:02 id=20085 trace_id=2 func=iprope_dnat_check line=5121 msg="in-[ssl.root], out-[]"
2024-04-27 12:40:02 id=20085 trace_id=2 func=iprope_dnat_tree_check line=823 msg="len=0"
2024-04-27 12:40:02 id=20085 trace_id=2 func=iprope_dnat_check line=5134 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
2024-04-27 12:40:02 id=20085 trace_id=2 func=vf_ip_route_input_common line=2615 msg="find a route: flag=84000000 gw-10.235.30.1 via root"
2024-04-27 12:40:02 id=20085 trace_id=2 func=iprope_fwd_check line=765 msg="in-[ssl.root], out-[VLAN30], skb_flags-02000000, vid-0, app_id: 0, url_cat_id: 0"
2024-04-27 12:40:02 id=20085 trace_id=2 func=__iprope_tree_check line=557 msg="gnum-100004, use addr/intf hash, len=2"
2024-04-27 12:40:02 id=20085 trace_id=2 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-3, ret-no-match, act-accept"
2024-04-27 12:40:02 id=20085 trace_id=2 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-0, ret-matched, act-accept"
2024-04-27 12:40:02 id=20085 trace_id=2 func=__iprope_user_identity_check line=1777 msg="ret-matched"
2024-04-27 12:40:02 id=20085 trace_id=2 func=__iprope_check_one_policy line=2174 msg="policy-0 is matched, act-drop"
2024-04-27 12:40:02 id=20085 trace_id=2 func=iprope_fwd_check line=806 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-drop, idx-0"
2024-04-27 12:40:02 id=20085 trace_id=2 func=fw_local_in_handler line=447 msg="iprope_in_check() check failed on policy 0, drop"
2024-04-27 12:40:07 id=20085 trace_id=3 func=print_pkt_detail line=5822 msg="vd-root:0 received a packet(proto=1, 172.16.0.50:1->10.235.30.1:2048) from ssl.root. type=8, code=0, id=1, seq=26."
2024-04-27 12:40:07 id=20085 trace_id=3 func=init_ip_session_common line=5993 msg="allocate a new session-0001e6af"
2024-04-27 12:40:07 id=20085 trace_id=3 func=iprope_dnat_check line=5121 msg="in-[ssl.root], out-[]"
2024-04-27 12:40:07 id=20085 trace_id=3 func=iprope_dnat_tree_check line=823 msg="len=0"
2024-04-27 12:40:07 id=20085 trace_id=3 func=iprope_dnat_check line=5134 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
2024-04-27 12:40:07 id=20085 trace_id=3 func=vf_ip_route_input_common line=2615 msg="find a route: flag=84000000 gw-10.235.30.1 via root"
2024-04-27 12:40:07 id=20085 trace_id=3 func=iprope_fwd_check line=765 msg="in-[ssl.root], out-[VLAN30], skb_flags-02000000, vid-0, app_id: 0, url_cat_id: 0"
2024-04-27 12:40:07 id=20085 trace_id=3 func=__iprope_tree_check line=557 msg="gnum-100004, use addr/intf hash, len=2"
2024-04-27 12:40:07 id=20085 trace_id=3 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-3, ret-no-match, act-accept"
2024-04-27 12:40:07 id=20085 trace_id=3 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-0, ret-matched, act-accept"
2024-04-27 12:40:07 id=20085 trace_id=3 func=__iprope_user_identity_check line=1777 msg="ret-matched"
2024-04-27 12:40:07 id=20085 trace_id=3 func=__iprope_check_one_policy line=2174 msg="policy-0 is matched, act-drop"
2024-04-27 12:40:07 id=20085 trace_id=3 func=iprope_fwd_check line=806 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-drop, idx-0"
2024-04-27 12:40:07 id=20085 trace_id=3 func=fw_local_in_handler line=447 msg="iprope_in_check() check failed on policy 0, drop"
2024-04-27 12:40:12 id=20085 trace_id=4 func=print_pkt_detail line=5822 msg="vd-root:0 received a packet(proto=1, 172.16.0.50:1->10.235.30.1:2048) from ssl.root. type=8, code=0, id=1, seq=27."
2024-04-27 12:40:12 id=20085 trace_id=4 func=init_ip_session_common line=5993 msg="allocate a new session-0001e6c8"
2024-04-27 12:40:12 id=20085 trace_id=4 func=iprope_dnat_check line=5121 msg="in-[ssl.root], out-[]"
2024-04-27 12:40:12 id=20085 trace_id=4 func=iprope_dnat_tree_check line=823 msg="len=0"
2024-04-27 12:40:12 id=20085 trace_id=4 func=iprope_dnat_check line=5134 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
2024-04-27 12:40:12 id=20085 trace_id=4 func=vf_ip_route_input_common line=2615 msg="find a route: flag=84000000 gw-10.235.30.1 via root"
2024-04-27 12:40:12 id=20085 trace_id=4 func=iprope_fwd_check line=765 msg="in-[ssl.root], out-[VLAN30], skb_flags-02000000, vid-0, app_id: 0, url_cat_id: 0"
2024-04-27 12:40:12 id=20085 trace_id=4 func=__iprope_tree_check line=557 msg="gnum-100004, use addr/intf hash, len=2"
2024-04-27 12:40:12 id=20085 trace_id=4 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-3, ret-no-match, act-accept"
2024-04-27 12:40:12 id=20085 trace_id=4 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-0, ret-matched, act-accept"
2024-04-27 12:40:12 id=20085 trace_id=4 func=__iprope_user_identity_check line=1777 msg="ret-matched"
2024-04-27 12:40:12 id=20085 trace_id=4 func=__iprope_check_one_policy line=2174 msg="policy-0 is matched, act-drop"
2024-04-27 12:40:12 id=20085 trace_id=4 func=iprope_fwd_check line=806 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-drop, idx-0"
2024-04-27 12:40:12 id=20085 trace_id=4 func=fw_local_in_handler line=447 msg="iprope_in_check() check failed on policy 0, drop"

[AEK]

The logs said policy-0 is matched, it means your configured policy didn't match the traffic.

• Please share the SSLVPN_TUNNEL_ADDR1 and "VLAN30 address" objects values
• Make sure the user you are connected with is in group RemoteUsers

[AEK]

Also, what is the destination interface in your policy? It must be VLAN30 otherwise it will not match the traffic.

[sahmed_FTNT]

try disabling offloading in the policy and try to collect logs,

also sniffer will be helpful to see where traffic is going out

[ssteo]

Hello jnapier4,

The firewall policy that you need is from source interface ssl.root to destination interface VLAN30.