1 Solution
this is not ipv4 polic problem but routing, when I ping from pc remote lan then I get on Windows CMD console "Destination net unreachable." because these echo request are going to internet:
GT # diagnose sniffer packet any "host 10.17.x.x" 4
interfaces=[any]
filters=[host 10.17.x.x]
5.041522 vlan10 in 10.10.x.x -> 10.17.x.x: icmp: echo request
5.041640 port23 out 205.x.x.x -> 10.17.x.x: icmp: echo request
5.044369 port23 in 10.17.x.x -> 205.x.x.x: icmp: echo reply
but my static routing to remote lan is configured:
edit 13
set dst 10.17.x.x 255.255.240.0
set device "W1-Branch-W1"
next
edit 18
set dst 10.17.x.x 255.255.240.0
set device "W2-Branch-W1"
next
FGT # get router info routing-table all
.
.
.
S 10.17.x.x/20 [10/0] is directly connected, W1-Branch-W1
[10/0] is directly connected, W2-Branch-W1
Responsible sd-wan rule for this traffic is at the top, but even don't get any hit counts (Fortigate do not use this sd-wan rule but force this traffic to internet)
Thanks gfleming I'm appreciate your help I'm stuck with this config, the same situation is on brach (it push traffic destined to ipsec tunnels to internet), now responding:
1.
FGT (sdwan) # config service
FGT (service) # show
config service
edit 8
set name "to_branch"
set dst "branch_subnet" (10.17.x.x/20 - all summarized subnet)
set src "all"
set priority-members 3 4 (these are ipsec tunnels w1-branch-w1, w2-branch-w1)
next
2.I have couple subnets on branch, lan with pc is with 10.17.2.x /24
Static route have for sure as destination two ipsec virtual interfaces:
as you can see I have other ipsec tunnels that are working but they are not in sd-wan, and they are configured in tunnel mode, so I have network configure in phase-2 selectors. These two ipsec that are member of sd-wan are in interface ipsec mode with zeroes in selectors.
3. ipsec phase-1 output:
FGT (W1-Branch-W1) # get
name : W1-Branch-W1
type : static
interface : port24
ip-version : 4
ike-version : 2
local-gw : 0.0.0.0
keylife : 86400
authmethod : psk
authmethod-remote :
peertype : any
net-device : disable
passive-mode : disable
exchange-interface-ip: disable
aggregate-member : disable
mode-cfg : disable
proposal : aes256-sha256
localid :
localid-type : auto
auto-negotiate : enable
negotiate-timeout : 30
fragmentation : enable
ip-fragmentation : post-encapsulation
dpd : on-idle
forticlient-enforcement: disable
comments :
npu-offload : enable
dhgrp : 19
suite-b : disable
eap : disable
ppk : disable
wizard-type : custom
reauth : disable
idle-timeout : disable
ha-sync-esp-seqno : enable
inbound-dscp-copy : disable
auto-discovery-sender: disable
auto-discovery-receiver: disable
auto-discovery-forwarder: disable
encapsulation : none
nattraversal : enable
fragmentation-mtu : 1200
childless-ike : disable
rekey : enable
fec-egress : disable
fec-ingress : disable
network-overlay : disable
remote-gw : wan-gateway-of-branch
monitor :
tunnel-search : selectors
add-gw-route : disable
psksecret : *
keepalive : 10
dpd-retrycount : 5
dpd-retryinterval : 120
4. packet flow when ping to branch lan pc
FGT # id=20085 trace_id=1 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=1, 10.10.x.x:5->10.17.2.x:2048) from vlan10. type=8, code=0, id=5, seq=27807."
id=20085 trace_id=1 func=init_ip_session_common line=5995 msg="allocate a new session-001e76e5"
id=20085 trace_id=1 func=vf_ip_route_input_common line=2589 msg="Match policy routing id=2130837510: to 10.17.2.x via ifindex-29"
id=20085 trace_id=1 func=vf_ip_route_input_common line=2615 msg="find a route: flag=04000000 gw-185.x.x.x via port23"
id=20085 trace_id=1 func=fw_forward_handler line=811 msg="Allowed by Policy-87: SNAT"
id=20085 trace_id=1 func=ids_receive line=298 msg="send to ips"
id=20085 trace_id=1 func=__ip_session_run_tuple line=3519 msg="SNAT 10.10.x.x->185.x.x.x:60421"
id=20085 trace_id=1 func=ipd_post_route_handler line=490 msg="out port23 vwl_zone_id 1, state2 0x4001, quality 0.as you see it outgoing my port23 which is wan.
