Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
SOD
New Contributor

Cannot exec ping from WAN interface

Hi,

I've got a strange problem with my Fortigate 800.

When I try to ping from the wan interface : FGT800-XX-XX $ execute ping-options source <WAN-IP>

                                                               FGT800-XX-XX $ execute ping 8.8.4.4

The ping doesn't work and I use diagnose debug flow trace to see where the icmp packet are going.

Here the result :

msg="enter IPsec tunnel-FGT-XXXX-XXXX" 2017-07-24 15:04:09 id=36871 trace_id=12559 func=ipsec_common_output4 line=595 msg="No matching IPsec selector, drop"

ICMP packet from wan interface are encapsuled in a VPN Tunnel instead of going to Internet directly.

 

I need this to configure Dead Gateway Detection option.

 

Thanks for help

 

1 Solution
ede_pfau
Esteemed Contributor III

A premium example of the hidden pitfalls of policy based VPN. The address objects in the policy are used both for the QM selectors and the routing. Too bad you can't see that.

Go with the golden advice and recreate the VPN in interface / route-based mode.


Ede

"Kernel panic: Aiee, killing interrupt handler!"

View solution in original post

Ede"Kernel panic: Aiee, killing interrupt handler!"
12 REPLIES 12
SOD
New Contributor

Ok I will migrate all vpn to interface mode.

 

Last question, do you think despite this problem I can configure Dead Gateway Detection based on ping ?

 

Thanks

ede_pfau
Esteemed Contributor III

Yes, sure. That's what DPD is designed for.

Additionally, I would create blackhole routes for each RFC1918 private subnet that you use. This prevents a WAN session to be created for VPN traffic in case the VPN breaks down. Makes tunnel recovery a lot faster. More info and batch command file for this on the forums ("blackhole").


Ede

"Kernel panic: Aiee, killing interrupt handler!"
Ede"Kernel panic: Aiee, killing interrupt handler!"
ipns
New Contributor III

Maybe you configured the tunnel to send all traffic through the VPN (remote address 0.0.0.0/0.0.0.0)?

Kind Regards, 

IPNS

Kind Regards, IPNS
Labels
Top Kudoed Authors