I've got a strange problem with my Fortigate 800.
When I try to ping from the wan interface : FGT800-XX-XX $ execute ping-options source <WAN-IP>
FGT800-XX-XX $ execute ping 220.127.116.11
The ping doesn't work and I use diagnose debug flow trace to see where the icmp packet are going.
Here the result :
msg="enter IPsec tunnel-FGT-XXXX-XXXX"
2017-07-24 15:04:09 id=36871 trace_id=12559 func=ipsec_common_output4 line=595 msg="No matching IPsec selector, drop"
ICMP packet from wan interface are encapsuled in a VPN Tunnel instead of going to Internet directly.
I need this to configure Dead Gateway Detection option.
Thanks for help
Go to Solution.
A premium example of the hidden pitfalls of policy based VPN. The address objects in the policy are used both for the QM selectors and the routing. Too bad you can't see that.
Go with the golden advice and recreate the VPN in interface / route-based mode.
View solution in original post
Welcome to the forums.
Try setting the PING options. Not sure of the exact syntax, but from a prompt type:
will get you a list of those options. One is source IP address which is why I think your PING request is failing.
Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
I've already set some options to see if the problem come from ping-options.
execute ping-options source <ip-of-my-wan-interface>
execute ping-options timeout 5
execute ping-options Validate Reply yes
options available :
FGT800-xx-01 $ execute ping-options view-settings
Repeat Count: 5
Data Size: 56
DF bit: unset
Source Address: auto
Pattern Size in Bytes: 0
Validate Reply: no
Have you set up a policy-based VPN on the WAN interface?
Yes i have some policy-based VPN on the wan Interface.
The diagnose sniffer above tell that the icmp packet is encapsulated to a policy based VPN.
Is there any reason why you use policy based VPN? I would just get rid of it and use a route based VPN, I guess you will eventually run into more problems with it in the future.
not really, today I only use route based vpn but before I used to configure policy based vpn.
I have another fortigate 200 with policy based vpn configure on it and I'm able to ping to @.
Do you have allowed every address in the VPN policy? Maybe you can filter it to only your local subnets and give it another shot
I don't use 0.0.0.0 (all) as destinaton or source in my vpn policy.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2023 Fortinet, Inc. All Rights Reserved.