Hi, all.
Funny thing. When I ran pcap suggested by @sjoshi, after 8-10 seconds suddenly it worked. I did nothing. Then I left to handle some other stuff, and when I came back it didn't work, again. That got me thinking about NP offloading or asymmetric routing issues, but I haven't been able to confirm this.
The interface IP is now 192.168.40.1 (tried quite a few things), and there is a new host in AWS (172.31.40.192). Sorry I can't drop the complete config here, for security reasons.
Here is a new capture, based on the suggestions:
FG-101F # diag sniff packet any 'host 192.168.40.1 and icmp' 4 0 1
interfaces=[any]
filters=[host 192.168.40.1 and icmp]
2.975748 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request
7.975738 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request
12.975803 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request
17.976778 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request
22.976357 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request
^C
5 packets received by filter
0 packets dropped by kernel
FG-101F # diag sys session filter proto 1
FG-101F # diag sys session filter dst 192.168.40.1
FG-101F # diag sys session list
session info: proto=1 proto_state=00 duration=37698 expire=58 timeout=0 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ tun_id=0.0.0.0/18.193.132.248 vlan_cos=0/0
state=local may_dirty npu
statistic(bytes/packets/allow_err): org=497040/8284/1 reply=56820/947/1 tuples=2
tx speed(Bps/kbps): 13/0 rx speed(Bps/kbps): 1/0
orgin->sink: org pre->in, reply out->post dev=77->36/36->78 gwy=192.168.40.1/0.0.0.0
hook=pre dir=org act=noop 172.31.40.192:1->192.168.40.1:8(0.0.0.0:0)
hook=post dir=reply act=noop 192.168.40.1:1->172.31.40.192:0(0.0.0.0:0)
misc=0 policy_id=53 pol_uuid_idx=0 auth_info=0 chk_client_info=0 vd=0
serial=000057c8 tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfwid=n/a
npu_state=0x000001 no_offload
npu info: flag=0x00/0x00, offload=0/0, ips_offload=0/0, epid=0/0, ipid=0/0, vlan=0x0000/0x0000
vlifid=0/0, vtag_in=0x0000/0x0000 in_npu=0/0, out_npu=0/0, fwd_en=0/0, qid=0/0
no_ofld_reason: local disabled-by-policy
total session 1
FG-101F # diag sniff packet any 'host 172.31.40.192 and icmp' 4 0 1
interfaces=[any]
filters=[host 172.31.40.192 and icmp]
3.714953 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request
8.711020 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request
10.301561 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.13: icmp: echo request
10.301644 lan out 172.31.40.192 -> 192.168.40.13: icmp: echo request
10.301648 fortilink out 172.31.40.192 -> 192.168.40.13: icmp: echo request
10.301653 x2 out 172.31.40.192 -> 192.168.40.13: icmp: echo request
10.301761 lan in 192.168.40.13 -> 172.31.40.192: icmp: echo reply
10.301790 vpn-0d40f99b-2 out 192.168.40.13 -> 172.31.40.192: icmp: echo reply
13.710008 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request
^C
9 packets received by filter
0 packets dropped by kernel
FG-101F # show firewall policy 53
config firewall policy
edit 53
set name "aws to office lan"
set uuid 813dbc08-842a-51ef-e803-b022fa3ef30e
set srcintf "vpn-0d40f99b"
set dstintf "lan"
set action accept
set srcaddr "AWS"
set dstaddr "lan address"
set schedule "always"
set service "ALL"
set logtraffic all
set capture-packet enable
set auto-asic-offload disable
next
end
FG-101F # show firewall policy 59
config firewall policy
edit 59
set name "aws 2 to lan"
set uuid 872e1386-842c-51ef-2e34-67700f53b3ed
set srcintf "vpn-0d40f99b-2"
set dstintf "lan"
set action accept
set srcaddr "AWS"
set dstaddr "lan address"
set schedule "always"
set service "ALL"
set logtraffic all
set capture-packet enable
set auto-asic-offload disable
next
end
I have discovered something strange (maybe), though. There is a mismatch in the static routes in the GUI and CLI (have removed routes not relevant, here):
FG-101F # get router info routing-table static
Routing table for VRF=0
S* 0.0.0.0/0 [10/0] via 195.159.198.177, wan1, [1/0]
S 169.254.87.188/30 [5/0] via vpn-0d40f99b-2 tunnel 52.58.248.162, [1/0]
S 169.254.91.32/30 [5/0] via vpn-0d40f99b tunnel 18.193.132.248, [1/0]
S 172.31.0.0/16 [20/0] via vpn-0d40f99b-2 tunnel 52.58.248.162, [1/0]
