Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
SOD
New Contributor

Cannot exec ping from WAN interface

Hi,

I've got a strange problem with my Fortigate 800.

When I try to ping from the wan interface : FGT800-XX-XX $ execute ping-options source <WAN-IP>

                                                               FGT800-XX-XX $ execute ping 8.8.4.4

The ping doesn't work and I use diagnose debug flow trace to see where the icmp packet are going.

Here the result :

msg="enter IPsec tunnel-FGT-XXXX-XXXX" 2017-07-24 15:04:09 id=36871 trace_id=12559 func=ipsec_common_output4 line=595 msg="No matching IPsec selector, drop"

ICMP packet from wan interface are encapsuled in a VPN Tunnel instead of going to Internet directly.

 

I need this to configure Dead Gateway Detection option.

 

Thanks for help

 

1 Solution
ede_pfau
Esteemed Contributor III

A premium example of the hidden pitfalls of policy based VPN. The address objects in the policy are used both for the QM selectors and the routing. Too bad you can't see that.

Go with the golden advice and recreate the VPN in interface / route-based mode.


Ede

"Kernel panic: Aiee, killing interrupt handler!"

View solution in original post

Ede"Kernel panic: Aiee, killing interrupt handler!"
12 REPLIES 12
rwpatterson
Valued Contributor III

Welcome to the forums.

 

Try setting the PING options. Not sure of the exact syntax, but from a prompt type:

ping-options ?

will get you a list of those options. One is source IP address which is why I think your PING request is failing.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
SOD

I've already set some options to see if the problem come from ping-options.

 

 execute ping-options source <ip-of-my-wan-interface>

 execute ping-options timeout 5

 execute ping-options  Validate Reply yes

 

options available :

FGT800-xx-01 $ execute ping-options view-settings Ping Options:         Repeat Count: 5         Data Size: 56         Timeout: 2         Interval: 1         TTL: 64         TOS: 0         DF bit: unset         Source Address: auto         Pattern:         Pattern Size in Bytes: 0         Validate Reply: no

Regards

oheigl
Contributor II

Have you set up a policy-based VPN on the WAN interface?

SOD
New Contributor

Hi,

 

Yes i have some policy-based VPN on the wan Interface.

 

The diagnose sniffer above tell that the icmp packet is encapsulated to a policy based VPN.

 

Regards

oheigl
Contributor II

Is there any reason why you use policy based VPN? I would just get rid of it and use a route based VPN, I guess you will eventually run into more problems with it in the future.

SOD
New Contributor

not really, today I only use route based vpn but before I used to configure policy based vpn.

 

I have another fortigate 200 with policy based vpn configure on it and I'm able to ping to @.

 

Really strange

 

oheigl
Contributor II

Do you have allowed every address in the VPN policy? Maybe you can filter it to only your local subnets and give it another shot

SOD
New Contributor

I don't use 0.0.0.0 (all) as destinaton or source in my vpn policy.

 

 

ede_pfau
Esteemed Contributor III

A premium example of the hidden pitfalls of policy based VPN. The address objects in the policy are used both for the QM selectors and the routing. Too bad you can't see that.

Go with the golden advice and recreate the VPN in interface / route-based mode.


Ede

"Kernel panic: Aiee, killing interrupt handler!"
Ede"Kernel panic: Aiee, killing interrupt handler!"
Top Kudoed Authors