Cannot ping interface IP from AWS VPN

[chocolateeater]

Hi, all.

I cannot ping a local interface IP on the Fortigate from a AWS host, connected through a VPN tunnel. I can ping the interface using a dial-up (FortiClient). It goes like this:

From PC connected through FortiClient (IP is 10.10.1.2):

Pinging 192.168.4.1 with 32 bytes of data:
Reply from 192.168.4.1: bytes=32 time=1ms TTL=255
Reply from 192.168.4.1: bytes=32 time=1ms TTL=255
Reply from 192.168.4.1: bytes=32 time=1ms TTL=255

From linux host in AWS:

PING 192.168.4.1 (192.168.4.1) 56(84) bytes of data.
(zzzzz)
--- 192.168.4.1 ping statistics ---
22 packets transmitted, 0 received, 100% packet loss, time 21481ms

To a host on the interface subnet, from linux host in AWS:

PING 192.168.4.13 (192.168.4.13) 56(84) bytes of data.
64 bytes from 192.168.4.13: icmp_seq=1 ttl=127 time=21.1 ms
64 bytes from 192.168.4.13: icmp_seq=2 ttl=127 time=21.2 ms

On the Fortigate, a trace shows

Packet Trace #2004,2024/12/04 08:57:54,"vd-root:0 received a packet(proto=1, 172.31.32.14:53603->192.168.4.1:2048) tun_id=18.193.132.24 from vpn-0d40f99b. type=8, code=0, id=53603, seq=3."
Packet Trace #2004,2024/12/04 08:57:54,"Find an existing session, id-232fd712, original direction"
Packet Trace #2005,2024/12/04 08:57:55,"vd-root:0 received a packet(proto=1, 172.31.32.14:53603->192.168.4.1:2048) tun_id=18.193.132.24 from vpn-0d40f99b. type=8, code=0, id=53603, seq=4."
Packet Trace #2005,2024/12/04 08:57:55,"Find an existing session, id-232fd712, original direction"
Packet Trace #2006,2024/12/04 08:57:56,"vd-root:0 received a packet(proto=1, 172.31.32.14:53603->192.168.4.1:2048) tun_id=18.193.132.24 from vpn-0d40f99b. type=8, code=0, id=53603, seq=5."
Packet Trace #2006,2024/12/04 08:57:56,"Find an existing session, id-232fd712, original direction"
Packet Trace #2007,2024/12/04 08:57:57,"vd-root:0 received a packet(proto=1, 172.31.32.14:53603->192.168.4.1:2048) tun_id=18.193.132.24 from vpn-0d40f99b. type=8, code=0, id=53603, seq=6."
Packet Trace #2007,2024/12/04 08:57:57,"Find an existing session, id-232fd712, original direction"

And the interface configuration:

edit "lan"
  set vdom "root"
  set ip 192.168.4.1 255.255.255.0
  set allowaccess ping https ssh snmp fabric
  set alias "office lan"
  set device-identification enable
  set role lan
  set snmp-index 11
  set interface "fortilink"
  set vlanid 2000
next

Any tips on why it doesn't work from the AWS VPN-tunnel?

Cheers,

Chocolate Eater

[chocolateeater]

Hi, @sjoshi .

Not using SD WAN. Not sure if I can direct traffic to a particular tunnel in AWS, but will look into it. Link monitor is in use, which is why it doesn't work to bring tunnel 2 down, it just goes back up. 

Here is the output:

FG-101F (link-monitor) # show
config system link-monitor
    edit "awsmon"
        set srcintf "vpn-0d40f99b"
        set server "169.254.87.189"
        set interval 2000
        set recoverytime 2
    next
end

FG-101F # diagnose vpn ike gateway list 
(...)
vd: root/0
name: vpn-0d40f99b
version: 1
interface: wan1 7
addr: 195.159.198.179:4500 -> 18.193.132.248:4500
tun_id: 18.193.132.248/::18.193.132.248
remote_location: 0.0.0.0
network-id: 0
virtual-interface-addr: 169.254.91.34 -> 169.254.91.33
created: 673s ago
peer-id: 18.193.132.248
peer-id-auth: no
nat: peer
IKE SA: created 1/1  established 1/1  time 70/70/70 ms
IPsec SA: created 1/1  established 1/1  time 110/110/110 ms

  id/spi: 60 6aae36d77afa1460/36d8f791bc7116d6
  direction: initiator
  status: established 673-673s ago = 70ms
  proposal: aes128-sha1
  key: 7fe3cff0abdbaaa7-08161b3d67bfa247
  lifetime/rekey: 28800/27826
  DPD sent/recv: 00000000/4522f231
  peer-id: 18.193.132.248

[sjoshi]

Can you share below command:-

diagnose sys link-monitor status

Seems your link monitor from tnl vpn-0d40f99b is down that is causing the issue

[chocolateeater]

FG-101F # diagnose sys link-monitor status

Link Monitor: awsmon, Status: dead, Server num(1), HA state: local(dead), shared(dead)
Flags=0x9 init log_downgateway, Create time: Wed Dec  4 22:32:44 2024
Source interface: vpn-0d40f99b (77)
VRF: 0
Interval: 2000 ms
Service-detect: disable
Diffservcode: 000000
Class-ID: 0
  Peer: 169.254.87.189(169.254.87.189) 
        Source IP(169.254.91.34)
        Route: 169.254.91.34->169.254.87.189/32, gwy(18.193.132.248)
        protocol: ping, state: dead
                Packet lost: 100.000%
                MOS: 4.350
                Number of out-of-sequence packets: 0
                Recovery times(0/2) Fail Times(2/5)
                Packet sent: 25367, received: 0, Sequence(sent/rcvd/exp): 25368/0/0

[sjoshi · Accepted solution]

yes your link monitor is in dead state that is why the route is in active

please remove the link monitor for now and the route should be active and check the communication

[chocolateeater]

SUCCESS!

Thanks a lot, @sjoshi. Much appreciated!