Fortigate AWS VPN Site to Site with RUT951 is up, but communication not bidirectional on sites.

[OrtizJorge97]

I have a site to site vpn mounted with my private subnet (10.0.1.0/24) and Teltonika router RUT951 subnet (192.168.10.0/24) which is connected to internet through dial up (SIM Card Telcel). The site to site is up and successfully running on phase1 and phase2 selectors..... But I canNOT ping or telnet from server in private net to the router RUT951 itself nor any device behind the router.

But I am able to do ping or telnet successfully from router RUT951 to server in private net.

From Fortigate CLI tried to do ping on 192.168.10.1, but no luck.

My guess is the issue should be on the firewall of the router RUT951, but I am new on this so I need help.

I have both policies allowing all access from RUT951 -> PRIVATE NET and PRIVATE NET -> RUT951 like below:

PRIVATE NET -> RUT951 Policy (This one does not work if doing ping or telnet disabling or enabling NAT, same result).

RUT951 -> PRIVATE NET (This one works perfect i can do ping or telnet)

Static Routes

IPSEC TUNNEL SITE TO SITE SUCCESS STATUS.

More context:

Fortigate in a VM in AWS.

Private subnet as 10.0.1.0/24 where private server resides.

Public facing subnet 10.0.0.0/24.

My Teltonika RUT951 router subnet 192.168.10.0/24 (Internet access through SIM Card Telcel, not WAN as such).

RUT951 router ip address 192.168.10.1

[dingjerry_FTNT]

Hi @OrtizJorge97 ,

It's because you configured the incorrect "addr" filter:

diag debug flow filter addr 10.0.1.10

It has to be 192.168.10.1

[OrtizJorge97]

Hi @dingjerry_FTNT ,

You are right, my bad there, here below I attach the debug commands with corrected ip address filter.

Fortigate CLI, this is how it was looking even after doing "ping 192.168.10.1"

Ping from private server after running debug commands.

Regards,

[ModEngine2]

It looks like you're facing a one-way communication issue in your site-to-site VPN setup between the Fortigate and RUT951 routers. Since the VPN tunnel is established and you can ping and telnet from the RUT951 router to your private network but not vice versa, there are a few areas to check.

First, verify the firewall policies on both devices. Ensure that the policies allowing traffic from your private network to the RUT951 subnet are configured correctly on the Fortigate. Double-check that NAT (Network Address Translation) is disabled in both directions, as enabling it could sometimes block communication from one side.

On the RUT951 side, check its firewall rules and ensure that it allows inbound traffic from the private network (10.0.1.0/24). Sometimes, routers like the RUT951 may have more restrictive firewall settings for inbound connections, so it's important to make sure it isn't blocking traffic from your VPN network.

[OrtizJorge97]

Hi @ModEngine2 ,

Yes, inbound rules and firewalls allow all traffic, what is happening after so much debugging is that resources (private server) in private subnet when doing ping to 192.168.10.0/24 dont know where to point the traffic to.

in FGT CLI I inspected ping request for 192.168.10.1 to see if at least the request is coming.

so from my 10.0.1.27 server do ping on 192.168.10.1, does not reach the port2 (10.0.1.10) interface of Fortigate.

Already modified the routing tables for pointing 192.168.10.0/24 destination to the network interface of port2.

[OrtizJorge97]

@dingjerry_FTNT Got a winner!

Turns out the problem was in the interface of FGT port2 Source/dest check was enabled in aws, this one did not allow to do ping to other ips which are not inside the 10.0.1.0/24, I just disabled this check, and now I got communication from private net to RUT951 device(s)!

[dingjerry_FTNT]

Ah, glad to hear that you fixed the issue. I knew that there was nothing wrong with FGT :)