FortiGate

[ITC_Techs]

We have an IPsec VPN between FortiGate 60E and SonicWall NSA 2600. The VPN is up and active but no traffic is passing across it.

[Dave_Hall]

Is there a route showing up for the tunnel?

[ITC_Techs]

There is. There is also a policy to allow inbound and outbound traffic

[sw2090]

are you sure the tunnel is up completely? Green in FGT Ipsec Monitor only means that phase1 has come up.

diag vpn tunnel list on cli will show you if is completely up.

If it shows phase2 name somewhere and a "sa=1" behind it it is up.

ALso could be something with ike. Look at my "strange ipsec vpn behavior " thread below for further details.

[emnoc]

the "diag debug flow" is your proper way to test this. It will show you if traffic is one matching the policy enforcing the route-base tunnel interface it will show if the traffic is being encrypted

On both sides NSA  and FGT you need policies and routes to be correct and matched.

Ken Felix

[ITC_Techs]

Policies and routes have been verified. We have another FGT101 with a VPN tunnel to the same NSA and all settings match just no traffic passing to/from FGT60E.

[rwpatterson]

On the cheap, where does a traceroute take your traffic?

[ITC_Techs]

Traceroute never gets out. All hops time out. Route is set up with destination network and VPN interface selected.

[ITC_Techs]

Attached is exerpt of diag sniffer packet on VPN tunnel interface. VPN is policy-based

[isamt]

Run a debug to identify if any issues with the config

diagnose debug disable diagnose vpn ike log-filter clear diagnose vpn ike log-filter dst-addr4 n.n.n.n diagnose debug app ike 255 diagnose debug enable

where n.n.n.n is the Public IP address of you SonicWall Firewall

to end:

diagnose debug disable diagnose debug reset