Hi,
I've got a strange problem with my Fortigate 800.
When I try to ping from the wan interface : FGT800-XX-XX $ execute ping-options source <WAN-IP>
FGT800-XX-XX $ execute ping 8.8.4.4
The ping doesn't work and I use diagnose debug flow trace to see where the icmp packet are going.
Here the result :
msg="enter IPsec tunnel-FGT-XXXX-XXXX" 2017-07-24 15:04:09 id=36871 trace_id=12559 func=ipsec_common_output4 line=595 msg="No matching IPsec selector, drop"
ICMP packet from wan interface are encapsuled in a VPN Tunnel instead of going to Internet directly.
I need this to configure Dead Gateway Detection option.
Thanks for help
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
A premium example of the hidden pitfalls of policy based VPN. The address objects in the policy are used both for the QM selectors and the routing. Too bad you can't see that.
Go with the golden advice and recreate the VPN in interface / route-based mode.
Welcome to the forums.
Try setting the PING options. Not sure of the exact syntax, but from a prompt type:
ping-options ?
will get you a list of those options. One is source IP address which is why I think your PING request is failing.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
I've already set some options to see if the problem come from ping-options.
execute ping-options source <ip-of-my-wan-interface>
execute ping-options timeout 5
execute ping-options Validate Reply yes
options available :
FGT800-xx-01 $ execute ping-options view-settings Ping Options: Repeat Count: 5 Data Size: 56 Timeout: 2 Interval: 1 TTL: 64 TOS: 0 DF bit: unset Source Address: auto Pattern: Pattern Size in Bytes: 0 Validate Reply: no
Regards
Have you set up a policy-based VPN on the WAN interface?
Hi,
Yes i have some policy-based VPN on the wan Interface.
The diagnose sniffer above tell that the icmp packet is encapsulated to a policy based VPN.
Regards
Is there any reason why you use policy based VPN? I would just get rid of it and use a route based VPN, I guess you will eventually run into more problems with it in the future.
not really, today I only use route based vpn but before I used to configure policy based vpn.
I have another fortigate 200 with policy based vpn configure on it and I'm able to ping to @.
Really strange
Do you have allowed every address in the VPN policy? Maybe you can filter it to only your local subnets and give it another shot
I don't use 0.0.0.0 (all) as destinaton or source in my vpn policy.
A premium example of the hidden pitfalls of policy based VPN. The address objects in the policy are used both for the QM selectors and the routing. Too bad you can't see that.
Go with the golden advice and recreate the VPN in interface / route-based mode.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1703 | |
1092 | |
752 | |
446 | |
229 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.