I am having a problem running an automation to backup my computer. I want to send the backup to a sftp server of a remote branch, connected to the fortigate equipment from which I make the backup, and it is as if it did not arrive. If I do a ping it arrives, but I have to specify the source. Does anyone have any idea how I can fix it?
The traffic and routes are allowed on both sides. But when I launch the "execute backup" it doesn't arrive. When pinging I have to add the source option to allow the traffic.
Packet Trace #7,2024/08/06 15:59:27,"vd-root:0 received a packet(proto=6, 181.14.198.42:6817->10.1.4.121:22) tun_id=0.0.0.0 from local. flag [S], seq 4203643946, ack 0, win 65535"
Packet Trace #7,2024/08/06 15:59:27,"Find an existing session, id-060b7b91, original direction"
Packet Trace #7,2024/08/06 15:59:27,"enter IPSec interface VPN_IPSec1, tun_id=0.0.0.0"
Packet Trace #7,2024/08/06 15:59:27,output to IPSec tunnel VPN_IPSec1 vrf 0
Packet Trace #7,2024/08/06 15:59:27,"No matching IPsec selector, drop"
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi Lucas, sometimes is necessary to configure an IP address in the Ipsec tunnel interfaces for this configuration to work. See the KB below:
Technical Tip: Configure automation backup over IPsec tunnel
Hello @Lucas1,
Please review https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-VPN-tunnel-errors-due-to-traff... as your debug says "No matching IPsec selector, drop" , which mean phase-2 configurations aren't matching on both sides. Make sure, all phase-2 configurations should be matched on Local, and remote firewall device.
Thanks,
Ronak Patel
Hi Lucas, sometimes is necessary to configure an IP address in the Ipsec tunnel interfaces for this configuration to work. See the KB below:
Technical Tip: Configure automation backup over IPsec tunnel
Excellent. This is the answer I was looking for. I will give it a try and see how it goes. Thank you very much.
Hi Lucas,
If the Backup server is hosted across the IPsec Tunnel, then you will need to define a source IP address on the FortiGate from where the backup is being initiated. Here is an article that would provide further details regardless of the backup services vendor:
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Auvik-backup-fails-while-Auvik-serve...
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1522 | |
1020 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.