IPSEC Rule will not be triggered

[Ratschko]

Hi!

I have a strange issue. On our 800C (V5.2.6) Cluster, i create a new IPSEC Policy Rule..like many others. But this rule seems

not to be triggered.

Source is 10.98.42.xxx and Dest is 192.168.199.100

Flow Diag:

id=20085 trace_id=27 func=print_pkt_detail line=4471 msg="vd-root received a packet(proto=1, 10.98.42.140:32773->192.168.199.100:8) from port3. code=8, type=0, id=32773, seq=0." id=20085 trace_id=27 func=init_ip_session_common line=4622 msg="allocate a new session-03b89454" id=20085 trace_id=27 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-217.89.79.3 via wan1" id=20085 trace_id=27 func=fw_forward_handler line=675 msg="Allowed by Policy-4: SNAT" id=20085 trace_id=27 func=ids_receive line=246 msg="send to ips" id=20085 trace_id=27 func=__ip_session_run_tuple line=2599 msg="SNAT 10.98.42.140->217.89.79.6:62464"

Policy (4) is our common Rule for Outside Access with NAT, but its nearly at the Ende of the policy (See Screenshot).

I have no idea where to start debugging. Has someone an Idea?

[Ratschko]

Yes! Up and Running.

Also, Traffic from the other side is working! ;) Weired..

[emnoc]

Is it one-way traffic as in the remote_lan can access but you can access from  the local_lan? I would still double check

 1:ordering

 2:ensure no defunct routes are left ( static or policy-based-routes)

If traffic is entering from the remote_lan find out what policy and start from that and double check. It's either bad policy, snat not required, bad cfg, or improper routes.....etc.