Cannot exec ping from WAN interface

[SOD]

Hi,

I've got a strange problem with my Fortigate 800.

When I try to ping from the wan interface : FGT800-XX-XX $ execute ping-options source <WAN-IP>

                                                               FGT800-XX-XX $ execute ping 8.8.4.4

The ping doesn't work and I use diagnose debug flow trace to see where the icmp packet are going.

Here the result :

msg="enter IPsec tunnel-FGT-XXXX-XXXX" 2017-07-24 15:04:09 id=36871 trace_id=12559 func=ipsec_common_output4 line=595 msg="No matching IPsec selector, drop"

ICMP packet from wan interface are encapsuled in a VPN Tunnel instead of going to Internet directly.

I need this to configure Dead Gateway Detection option.

Thanks for help

[SOD]

Ok I will migrate all vpn to interface mode.

Last question, do you think despite this problem I can configure Dead Gateway Detection based on ping ?

Thanks

[ede_pfau]

Yes, sure. That's what DPD is designed for.

Additionally, I would create blackhole routes for each RFC1918 private subnet that you use. This prevents a WAN session to be created for VPN traffic in case the VPN breaks down. Makes tunnel recovery a lot faster. More info and batch command file for this on the forums ("blackhole").

[ipns]

Maybe you configured the tunnel to send all traffic through the VPN (remote address 0.0.0.0/0.0.0.0)?