IPSEC Phase1 & Phase2 UP, But No Download Traffic On Brach Site

[_afriansyah]

Dear Support Forum,

I have an ipsec tunnel problem from branch to HO, where the download traffic from branch to HO remains 0 bytes,
and in the configuration of the ipsec tunnel HO to the branch the peer id (gC.b) appears as the username.

Is there anyone who can help to solve this problem?

[DPadula]

Are both Fortigates running the same FortiOS version?
Can you see the firewall policy byte counter increasing?

[_afriansyah]

Are both Fortigates running the same FortiOS version?
Yes, Running the same FortiOS Version

Firewall Policy byte counter on Branch

[DPadula]

Run the command 'diagnose netlink device list' few times and confirm that you can see the counters increasing for the tunnel interfaces. 

[_afriansyah]

Here the Result @DPadula ,

FortiGate-100F # diagnose netlink device list
Inter-| Receive | Transmit
face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed
TestIndosat: 0 0 0 0 0 0 0 0 448732 8426 197398 0 0 0 0 0

[_afriansyah]

FortiGate-100F # diagnose netlink device list
Inter-| Receive | Transmit
face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed
TestIndosat: 0 0 0 0 0 0 0 0 448732 8426 197398 0 0 0 0 0
Site2HO: 0 0 0 0 0 0 0 0 9679449 254556 841 0 0 0 0 0

[DPadula]

Did you generated some VPN traffic while you checked the output of 'diagnose netlink device list'? The idea is confirm that the counters Bytes and packets are increasing while traffic cross the VPN tunnel. So run the command, generated some traffic, wait few seconds, run the command again.

In case you don't see any increase, use the commands provided by @sw2090 to understand what is happening with the traffic, it will show which firewall policy matches the traffic. 

Once you confirm that traffic is matching the right policy you know that it is a cosmetic problem.

[sw2090]

Do the phase2 selectors match?

Do a flow debug on cli:

dia debug ena

dia debug flow fliter clear

die debug flow filter saddr/daddr/proto/... (execute it without params and it will show a list)

dia debug flow trace start <numberofpackets>

start that on both FGT and then produce some traffic on the vpn and the flow will on both sides show you the packet flow. 

[_afriansyah]

Halo @sw2090 ,
Phase 1 & Phase 2 match, and already up
IPSEC problem only with ISP "JSN"

i try to use another ISP, IPSEC with another ISP work normally, 
download and upload traffic no issue from Branch to HO.

is problem with the ISP "JSN" ?