Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Ratschko
New Contributor

IPSEC Rule will not be triggered

Hi!

 

I have a strange issue. On our 800C (V5.2.6) Cluster, i create a new IPSEC Policy Rule..like many others. But this rule seems

not to be triggered.

Source is 10.98.42.xxx and Dest is 192.168.199.100

 

Flow Diag:

id=20085 trace_id=27 func=print_pkt_detail line=4471 msg="vd-root received a packet(proto=1, 10.98.42.140:32773->192.168.199.100:8) from port3. code=8, type=0, id=32773, seq=0." id=20085 trace_id=27 func=init_ip_session_common line=4622 msg="allocate a new session-03b89454" id=20085 trace_id=27 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-217.89.79.3 via wan1" id=20085 trace_id=27 func=fw_forward_handler line=675 msg="Allowed by Policy-4: SNAT" id=20085 trace_id=27 func=ids_receive line=246 msg="send to ips" id=20085 trace_id=27 func=__ip_session_run_tuple line=2599 msg="SNAT 10.98.42.140->217.89.79.6:62464"

 

Policy (4) is our common Rule for Outside Access with NAT, but its nearly at the Ende of the policy (See Screenshot).

 

I have no idea where to start debugging. Has someone an Idea?

 

 

 

11 REPLIES 11
Ratschko

Yes! Up and Running.

 

Also, Traffic from the other side is working! ;) Weired..

emnoc
Esteemed Contributor III

Is it one-way traffic as in the remote_lan can access but you can access from  the local_lan? I would still double check

 

 1:ordering

 2:ensure no defunct routes are left ( static or policy-based-routes)

 

If traffic is entering from the remote_lan find out what policy and start from that and double check. It's either bad policy, snat not required, bad cfg, or improper routes.....etc.

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors