Cannot exec ping from WAN interface

[SOD]

Hi,

I've got a strange problem with my Fortigate 800.

When I try to ping from the wan interface : FGT800-XX-XX $ execute ping-options source <WAN-IP>

                                                               FGT800-XX-XX $ execute ping 8.8.4.4

The ping doesn't work and I use diagnose debug flow trace to see where the icmp packet are going.

Here the result :

msg="enter IPsec tunnel-FGT-XXXX-XXXX" 2017-07-24 15:04:09 id=36871 trace_id=12559 func=ipsec_common_output4 line=595 msg="No matching IPsec selector, drop"

ICMP packet from wan interface are encapsuled in a VPN Tunnel instead of going to Internet directly.

I need this to configure Dead Gateway Detection option.

Thanks for help

[rwpatterson]

Welcome to the forums.

Try setting the PING options. Not sure of the exact syntax, but from a prompt type:

ping-options ?

will get you a list of those options. One is source IP address which is why I think your PING request is failing.

[SOD]

I've already set some options to see if the problem come from ping-options.

 execute ping-options source <ip-of-my-wan-interface>

 execute ping-options timeout 5

 execute ping-options  Validate Reply yes

options available :

FGT800-xx-01 $ execute ping-options view-settings Ping Options:         Repeat Count: 5         Data Size: 56         Timeout: 2         Interval: 1         TTL: 64         TOS: 0         DF bit: unset         Source Address: auto         Pattern:         Pattern Size in Bytes: 0         Validate Reply: no

Regards

[oheigl]

Have you set up a policy-based VPN on the WAN interface?

[SOD]

Hi,

Yes i have some policy-based VPN on the wan Interface.

The diagnose sniffer above tell that the icmp packet is encapsulated to a policy based VPN.

Regards

[oheigl]

Is there any reason why you use policy based VPN? I would just get rid of it and use a route based VPN, I guess you will eventually run into more problems with it in the future.

[SOD]

not really, today I only use route based vpn but before I used to configure policy based vpn.

I have another fortigate 200 with policy based vpn configure on it and I'm able to ping to @.

Really strange

[oheigl]

Do you have allowed every address in the VPN policy? Maybe you can filter it to only your local subnets and give it another shot

[SOD]

I don't use 0.0.0.0 (all) as destinaton or source in my vpn policy.

[ede_pfau · Accepted solution]

A premium example of the hidden pitfalls of policy based VPN. The address objects in the policy are used both for the QM selectors and the routing. Too bad you can't see that.

Go with the golden advice and recreate the VPN in interface / route-based mode.