Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Ratschko
New Contributor

IPSEC Rule will not be triggered

Hi!

 

I have a strange issue. On our 800C (V5.2.6) Cluster, i create a new IPSEC Policy Rule..like many others. But this rule seems

not to be triggered.

Source is 10.98.42.xxx and Dest is 192.168.199.100

 

Flow Diag:

id=20085 trace_id=27 func=print_pkt_detail line=4471 msg="vd-root received a packet(proto=1, 10.98.42.140:32773->192.168.199.100:8) from port3. code=8, type=0, id=32773, seq=0." id=20085 trace_id=27 func=init_ip_session_common line=4622 msg="allocate a new session-03b89454" id=20085 trace_id=27 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-217.89.79.3 via wan1" id=20085 trace_id=27 func=fw_forward_handler line=675 msg="Allowed by Policy-4: SNAT" id=20085 trace_id=27 func=ids_receive line=246 msg="send to ips" id=20085 trace_id=27 func=__ip_session_run_tuple line=2599 msg="SNAT 10.98.42.140->217.89.79.6:62464"

 

Policy (4) is our common Rule for Outside Access with NAT, but its nearly at the Ende of the policy (See Screenshot).

 

I have no idea where to start debugging. Has someone an Idea?

 

 

 

11 REPLIES 11
emnoc
Esteemed Contributor III

I would start via the route, remember route for SNAT traffic takes 1st this how/why the traffic goes out of the wan1 fo dst subnet 192.168.199.100

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Ratschko
New Contributor

Sorry..many questions marks over my head :)

 

What do you mean where i could search?

emnoc
Esteemed Contributor III

cli show router static would be a start, or from the webgui system >  routes > static-route  & after the vpn is up look in the route monitor for that destination

 

Above is all assuming this is a route-based vpn and that you have a "named phase1-interface"

 

Read the fortigate cookbook,but they have done a great job crafting howto for ipsec  route-based vpns.

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Ratschko
New Contributor

I have policy-based ipsec rules, no routing entrys. I have no ipsec interface mode. Therefore , there is no routing entry for the private subnet..nor for the others that are working.

emnoc
Esteemed Contributor III

Check your fwpolicy order/subnets &  than and still look at the ordering. PB-vpn are not easiest  to t-shoot when compared to a route-based vpn.

 

Also double check the vpn phase1 & 2 details ( src/dst address typo,etc....)

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
rwpatterson
Valued Contributor III

Policy based VPNs are always first in the policy ordering. This is a must.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
emnoc
Esteemed Contributor III

And one more things, fwpolicy sequence is a must,  but also double and triple check the out-going interface. I t-shoot a pb-vpn with a customer and we mistakenly over looked the destination interface and what i also found if you add multiple interfaces in the destination it would also problems.

 

Base on the dstintf  the  ipsec policy will become active if the traffic matches and proposal are accepted.

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Ratschko

Yes, it is. Sorry but iam completly confused. The vpn policy is nearly on top and the common nat-rule is at nearly end.

And i have no idea why this rule is not triggered.

- checked source network/mask

- check destination network/mask

(src interface=internal, outgoing=wan)

1...

2...

3.. src=10.98.0.0, dst=192.168.199.0, ipsec

4.

...

32. src=10.98.99.0, dst=any, nat

 

But this vpn rule (3) is ignored if i send ping from 10.98.99.xxx to 192.168.199.100

 

Thanks alot for your time!

 

Best regards,

tobias

rwpatterson
Valued Contributor III

Is the tunnel up? VPN > Monitor > IPSec

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors