Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Cannot exec ping from WAN interface


I've got a strange problem with my Fortigate 800.

When I try to ping from the wan interface : FGT800-XX-XX $ execute ping-options source <WAN-IP>

                                                               FGT800-XX-XX $ execute ping

The ping doesn't work and I use diagnose debug flow trace to see where the icmp packet are going.

Here the result :

msg="enter IPsec tunnel-FGT-XXXX-XXXX" 2017-07-24 15:04:09 id=36871 trace_id=12559 func=ipsec_common_output4 line=595 msg="No matching IPsec selector, drop"

ICMP packet from wan interface are encapsuled in a VPN Tunnel instead of going to Internet directly.


I need this to configure Dead Gateway Detection option.


Thanks for help


1 Solution

A premium example of the hidden pitfalls of policy based VPN. The address objects in the policy are used both for the QM selectors and the routing. Too bad you can't see that.

Go with the golden advice and recreate the VPN in interface / route-based mode.

Ede Kernel panic: Aiee, killing interrupt handler!

View solution in original post

Ede Kernel panic: Aiee, killing interrupt handler!
New Contributor

Ok I will migrate all vpn to interface mode.


Last question, do you think despite this problem I can configure Dead Gateway Detection based on ping ?




Yes, sure. That's what DPD is designed for.

Additionally, I would create blackhole routes for each RFC1918 private subnet that you use. This prevents a WAN session to be created for VPN traffic in case the VPN breaks down. Makes tunnel recovery a lot faster. More info and batch command file for this on the forums ("blackhole").

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
New Contributor III

Maybe you configured the tunnel to send all traffic through the VPN (remote address

Kind Regards, 


Kind Regards, IPNS

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors