Forticlient vpn SSL: lan unable to ping clients, but others protocols are ok

[mspada]

Hi all, when an ssl client is connected it can ping a host on the lan, but not vice versa. The same problem is between two connected SSL clients. The strange thing is that, on the contrary, the VNC (like access to remote desktop) works correctly. I made all the correct policies. You can help me? Firmware 6.4.8 and SD-WAN configured.
I have some doubts about the Portal, you know that activating the spli-tunnel even if you do not declare the lan to reach, you can do it in the policy, and so I did. Thank you

[Markus_M]

Hello Marco,

you can check logs for the traffic. You suspect it to hit a policy, then confirm that is the case.

Helped me a lot:

diag debug console timestamp enable
diag debug flow filter proto 1 <that is ICMP>
diag debug flow filter addr <some address you expect in the traffic>
diag debug enable
diag debug flow trace start 20
Then run a fresh ping both ways. It will show you 20 packets for firewall policy evaluation.

Best regards,

Markus

[mspada]

MITI_master # diagnose debug console timestamp enable

MITI_master #
MITI_master # diag debug flow filter proto 1

MITI_master # diag debug flow filter addr 192.168.200.1

MITI_master # diag debug enable

MITI_master #
MITI_master #
MITI_master # diag debug flow trace start 20

MITI_master #
MITI_master #
MITI_master # execute ping 192.168.200.1
PING 192.168.200.1 (192.168.200.1): 56 data bytes
2022-03-21 13:39:03 id=20085 trace_id=1 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=1, 151.8.217.197:42547->192.168.200.1:2048) from local. type=8, code=0, id=42547, seq=0."
2022-03-21 13:39:03 id=20085 trace_id=1 func=init_ip_session_common line=5898 msg="allocate a new session-013e42ec"
2022-03-21 13:39:03 id=20085 trace_id=1 func=ipd_post_route_handler line=490 msg="out ssl.root vwl_zone_id 0, state2 0x0, quality 0.
"
2022-03-21 13:39:04 id=20085 trace_id=2 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=1, 151.8.217.197:42547->192.168.200.1:2048) from local. type=8, code=0, id=42547, seq=1."
2022-03-21 13:39:04 id=20085 trace_id=2 func=resolve_ip_tuple_fast line=5808 msg="Find an existing session, id-013e42ec, original direction"
2022-03-21 13:39:04 id=20085 trace_id=2 func=ipd_post_route_handler line=490 msg="out ssl.root vwl_zone_id 0, state2 0x0, quality 0.
"
2022-03-21 13:39:05 id=20085 trace_id=3 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=1, 151.8.217.197:42547->192.168.200.1:2048) from local. type=8, code=0, id=42547, seq=2."
2022-03-21 13:39:05 id=20085 trace_id=3 func=resolve_ip_tuple_fast line=5808 msg="Find an existing session, id-013e42ec, original direction"
2022-03-21 13:39:05 id=20085 trace_id=3 func=ipd_post_route_handler line=490 msg="out ssl.root vwl_zone_id 0, state2 0x0, quality 0.
"
2022-03-21 13:39:06 id=20085 trace_id=4 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=1, 151.8.217.197:42547->192.168.200.1:2048) from local. type=8, code=0, id=42547, seq=3."
2022-03-21 13:39:06 id=20085 trace_id=4 func=resolve_ip_tuple_fast line=5808 msg="Find an existing session, id-013e42ec, original direction"
2022-03-21 13:39:06 id=20085 trace_id=4 func=ipd_post_route_handler line=490 msg="out ssl.root vwl_zone_id 0, state2 0x0, quality 0.
"
2022-03-21 13:39:07 id=20085 trace_id=5 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=1, 151.8.217.197:42547->192.168.200.1:2048) from local. type=8, code=0, id=42547, seq=4."
2022-03-21 13:39:07 id=20085 trace_id=5 func=resolve_ip_tuple_fast line=5808 msg="Find an existing session, id-013e42ec, original direction"
2022-03-21 13:39:07 id=20085 trace_id=5 func=ipd_post_route_handler line=490 msg="out ssl.root vwl_zone_id 0, state2 0x0, quality 0.
"

--- 192.168.200.1 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss

[mspada]

I'm connected in vpn ssl:

Suffisso DNS specifico per connessione:
Indirizzo IPv6 locale rispetto al collegamento . : fe80::a52b:2b17:816e:c708%7
Indirizzo IPv4. . . . . . . . . . . . : 192.168.200.5
Subnet mask . . . . . . . . . . . . . : 255.255.255.255
Gateway predefinito . . . . . . . . . :

[Debbie_FTNT · Accepted solution]

In addition to what Markus suggested to check:

- If the clients are Windows PCs, check if the Windows Firewall is turned on

-> by default, Windows clients do NOT react to ping requests they receive