Fortigate 200D (v5.6.2) IPSec VPN to AWS. Traffic makes it to EC2 but not back.

[cgbaroudi]

Hi,

I have 2 VPNs UP with AWS VPC. The VPNs are configured with failover so if one goes down the other picks up. Below we can see one VPN is up:

34.232.188.255 169.254.47.44/30 DOWN52.86.222.130 169.254.44.184/30 UP 

Info:

1. When I ping from my Fortigate to the EC2, I can see that the EC2 receives the ping request and sends a reply. The reply however never makes it back through the tunnel:tcpdump output on the AWS EC2:12:50:58.923392 IP 169.254.44.186 > 192.168.241.142: ICMP echo request, id 2769612:50:58.923405 IP 192.168.241.142 > 169.254.44.186: ICMP echo reply, id 276963. 2. From the fortigate I can ping both ends of the tunnel which is obvious from the time in ms: execute ping 169.254.44.185

PING 169.254.44.185 (169.254.44.185): 56 data bytes64 bytes from 169.254.44.185: icmp_seq=0 ttl=254 time=13.0 ms64 bytes from 169.254.44.185: icmp_seq=1 ttl=254 time=13.1 ms

execute ping 169.254.44.186

PING 169.254.44.186 (169.254.44.186): 56 data bytes64 bytes from 169.254.44.186: icmp_seq=0 ttl=255 time=0.0 ms64 bytes from 169.254.44.186: icmp_seq=1 ttl=255 time=0.0 ms4. 3. From the EC2 I cannot ping either end of the tunnel.5. SSH fails in the same way. 4. We see ssh session attempts and replies which do not make it back from the EC2:

06:00:30.829303 IP 192.168.241.142.ssh > 169.254.44.186.9589: Flags [S.], seq 2689521519, ack 2166390256, win 26847, options [mss 8961,sackOK,TS val 4354044 ecr 236943444,nop,wscale 7], length 0 06:00:38.633577 IP 169.254.44.186.9589 > 192.168.241.142.ssh: Flags , seq 2166390255, win 5272, options [mss 1318,sackOK,TS val 236945544 ecr 0,nop,wscale 2], length 0

Seems that traffic from the EC2 back to the Fortigate is being blocked yet debug flow on the fortigate shows no attempts or denial:

# execute ssh 192.168.241.142 id=20085 trace_id=2273 func=print_pkt_detail line=5293 msg="vd-root received a packet(proto=6, 169.254.44.186:9589->192.168.241.142:22) from local. flag , seq 2166390255, ack 0, win 5272" id=20085 trace_id=2273 func=init_ip_session_common line=5449 msg="allocate a new session-01a8007c" id=20085 trace_id=2273 func=iprope_dnat_check line=4754 msg="in-[], out-[vpn-23766442-1]" id=20085 trace_id=2273 func=iprope_dnat_tree_check line=835 msg="len=0" id=20085 trace_id=2273 func=iprope_dnat_check line=4767 msg="result: skb_flags-00000000, vid-0, ret-no-match, act-accept, flag-00000000" id=20085 trace_id=2273 func=ipsecdev_hard_start_xmit line=144 msg="enter IPsec interface-vpn-23766442-1" id=20085 trace_id=2273 func=esp_output4 line=1174 msg="IPsec encrypt/auth" id=20085 trace_id=2273 func=ipsec_output_finish line=534 msg="send to 66.162.199.129 via intf-wan1"

Any ideas would be very helpful. Please!!!

Thank you and Best Regards.

[emnoc]

I'm glad it all worked out for you in  the end.

Ken