Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

FortiGate IPsec Configuration - Unable to Establish Internet Access for AWS EC2 Instances

Hello Fortinet community,


I have set up an IPsec connection from FortiGate to AWS, and I'm currently facing a challenge with enabling internet access for my AWS EC2 instances through the IPsec tunnel. Here's a brief overview of my setup:

  • AWS VPC: I have a private subnet containing various services, including EC2 instances.
  • FortiGate: I have two networks - a DMZ network and an internal network. Both can communicate with the EC2 instances without any issues.

However, I want to allow the following path for my EC2 instances:

EC2 ===> FortiGate 1 ===> Internet

To achieve this, I've configured the AWS route table to have a route with destination pointing to the virtual private gateway (VGW) to handle internet-bound traffic.

On the FortiGate side, I've implemented two policies. The first policy allows traffic from the WAN to AWS IPsec, and the second policy allows traffic from AWS IPsec to the WAN.

Despite these configurations, the setup isn't functioning as expected. When capturing traffic on the FortiGate, I see the following result for a ping request:

1 0.000000 ICMP 60 Echo (ping) request id=0x0001, seq=51820/27850, ttl=128 (no response found!)

This suggests that the ping request from (presumably one of the EC2 instances) to (Google's DNS server) did not receive a response.

I'd greatly appreciate any guidance, suggestions, or troubleshooting steps to resolve this issue and enable internet access for my AWS EC2 instances via the FortiGate IPsec connection.


Thank you for your time and assistance!



hello @stevediaz ,

Are you seeing sessions are establishing on firewall for this traffic ? If not, you might have to check the route for the source IP. It should be through the same IPsec tunnel, or else it would drop due to RPF check. 
Also ensure the NAT is being applied on policy to go out.

To check the sessions:
diag sys session filter dst

diag sys session filter src <EC2 instance IP>

diag sys session filter proto 1

diag sys session list

Top Kudoed Authors