Help
Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Sulwan_Suliman
New Contributor

Created on ‎10-10-2024 06:36 PM

IPSEC VPN Local cannot reach/ping Remote site without including DMZ segment

Hi, I have an issue where I create an IPSEC Tunnel to a Cloud server, the tunnel is up but local LAN cannot reach and ping to remote site. After checking the traffic, somehow the traffic is going through the DMZ interface which we currently not using and down. After we add the DMZ IP segment to local address on FortiGate, and add to remote on the Remote cloud, we can reach and ping between the sites. I want to know why it still going through DMZ IP segment even though we are not using the DMZ port and it currently down? Our device is Fortigate 100F, version 7.4.4

Labels:
630
0 Kudos
8 REPLIES 8
dbhavsar
Staff
Staff

Created on ‎10-11-2024 01:22 PM

Hello @Sulwan_Suliman,

 

- What is the destination subnet you are trying to reach and what is the subnet you are using in DMZ?

DNB
534
Sulwan_Suliman
New Contributor
In response to dbhavsar

Created on ‎10-14-2024 07:20 PM

Hi, my destination subnet is 10.50.20.0/24 and the DMZ is 10.10.10.1/24. However as I mentioned, this DMZ is currently down as we are not using it.

435
0 Kudos
Shashwati
Staff
Staff

Created on ‎10-11-2024 02:40 PM

Hello 

Please run packet capture and debug while testing the connection 

 

diag sniffer packet any 'Host X.X.X.X' 6 0 l   [Remote IP]

 

diagnose debug reset
diagnose debug flow trace stop
diagnose debug flow filter clear
diagnose debug flow filter addr X.X.X.X
diagnose debug flow show function-name enable
diagnose debug console timestamp enable
diagnose debug flow trace start 100000
diagnose debug enable

 

Run this to stop the debug

diagnose debug disable 

522
Sulwan_Suliman
New Contributor
In response to Shashwati

Created on ‎10-14-2024 07:48 PM

Hi, below is the result:

 

# diag sniffer packet any 'Host 10.50.20.10' 6 0 l
interfaces=[any]
filters=[Host 10.50.20.10]
pcap_compile: can't parse filter expression: syntax error

SMD-CRP-FW01 # diagnose debug reset

SMD-CRP-FW01 # diagnose debug flow trace stop

SMD-CRP-FW01 # diagnose debug flow filter clear

SMD-CRP-FW01 # diagnose debug flow filter addr 10.50.20.10

SMD-CRP-FW01 # diagnose debug flow show function-name enable
show function name

SMD-CRP-FW01 # diagnose debug console timestamp enable

SMD-CRP-FW01 # diagnose debug flow trace start 100000

SMD-CRP-FW01 # diagnose debug enable

SMD-CRP-FW01 # 2024-10-15 10:47:21 id=65308 trace_id=36 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=46."
2024-10-15 10:47:21 id=65308 trace_id=36 func=init_ip_session_common line=6063 msg="allocate a new session-04ada894"
2024-10-15 10:47:21 id=65308 trace_id=36 func=vf_ip_route_input_common line=2612 msg="find a route: flag=04000000 gw-103.186.161.230 via To SDeCloud"
2024-10-15 10:47:21 id=65308 trace_id=36 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=39, len=4"
2024-10-15 10:47:21 id=65308 trace_id=36 func=get_new_addr line=1265 msg="find SNAT: IP-10.10.10.1(from IPPOOL), port-60418"
2024-10-15 10:47:21 id=65308 trace_id=36 func=fw_forward_handler line=987 msg="Allowed by Policy-4: SNAT"
2024-10-15 10:47:21 id=65308 trace_id=36 func=ids_receive line=464 msg="send to ips"
2024-10-15 10:47:21 id=65308 trace_id=36 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:21 id=65308 trace_id=36 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=0.0.0.0"
2024-10-15 10:47:21 id=65308 trace_id=36 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:21 id=65308 trace_id=36 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:21 id=65308 trace_id=36 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:21 id=65308 trace_id=37 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=46."
2024-10-15 10:47:21 id=65308 trace_id=37 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:21 id=65308 trace_id=37 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:21 id=65308 trace_id=37 func=vf_ip_route_input_common line=2612 msg="find a route: flag=00000000 gw-10.0.20.35 via General WiFi"
2024-10-15 10:47:21 id=65308 trace_id=37 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000000 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:21 id=65308 trace_id=37 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:22 id=65308 trace_id=38 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=47."
2024-10-15 10:47:22 id=65308 trace_id=38 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, original direction"
2024-10-15 10:47:22 id=65308 trace_id=38 func=npu_handle_session44 line=1224 msg="Trying to offloading session from General WiFi to To SDeCloud, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x01041008"
2024-10-15 10:47:22 id=65308 trace_id=38 func=fw_forward_dirty_handler line=442 msg="state=00000204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:22 id=65308 trace_id=38 func=ip_session_core_in line=6563 msg="dir-0, tun_id=103.186.161.230"
2024-10-15 10:47:22 id=65308 trace_id=38 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:22 id=65308 trace_id=38 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=103.186.161.230"
2024-10-15 10:47:22 id=65308 trace_id=38 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:22 id=65308 trace_id=38 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:22 id=65308 trace_id=38 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:22 id=65308 trace_id=39 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=47."
2024-10-15 10:47:22 id=65308 trace_id=39 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:22 id=65308 trace_id=39 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:22 id=65308 trace_id=39 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:22 id=65308 trace_id=39 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:23 id=65308 trace_id=40 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=48."
2024-10-15 10:47:23 id=65308 trace_id=40 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, original direction"
2024-10-15 10:47:23 id=65308 trace_id=40 func=npu_handle_session44 line=1224 msg="Trying to offloading session from General WiFi to To SDeCloud, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x01041008"
2024-10-15 10:47:23 id=65308 trace_id=40 func=fw_forward_dirty_handler line=442 msg="state=00000204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:23 id=65308 trace_id=40 func=ip_session_core_in line=6563 msg="dir-0, tun_id=103.186.161.230"
2024-10-15 10:47:23 id=65308 trace_id=40 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:23 id=65308 trace_id=40 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=103.186.161.230"
2024-10-15 10:47:23 id=65308 trace_id=40 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:23 id=65308 trace_id=40 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:23 id=65308 trace_id=40 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:23 id=65308 trace_id=41 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=48."
2024-10-15 10:47:23 id=65308 trace_id=41 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:23 id=65308 trace_id=41 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:23 id=65308 trace_id=41 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:23 id=65308 trace_id=41 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:24 id=65308 trace_id=42 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=49."
2024-10-15 10:47:24 id=65308 trace_id=42 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, original direction"
2024-10-15 10:47:24 id=65308 trace_id=42 func=npu_handle_session44 line=1224 msg="Trying to offloading session from General WiFi to To SDeCloud, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x01041008"
2024-10-15 10:47:24 id=65308 trace_id=42 func=fw_forward_dirty_handler line=442 msg="state=00000204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:24 id=65308 trace_id=42 func=ip_session_core_in line=6563 msg="dir-0, tun_id=103.186.161.230"
2024-10-15 10:47:24 id=65308 trace_id=42 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:24 id=65308 trace_id=42 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=103.186.161.230"
2024-10-15 10:47:24 id=65308 trace_id=42 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:24 id=65308 trace_id=42 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:24 id=65308 trace_id=42 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:24 id=65308 trace_id=43 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=49."
2024-10-15 10:47:24 id=65308 trace_id=43 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:24 id=65308 trace_id=43 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:24 id=65308 trace_id=43 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:24 id=65308 trace_id=43 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"

425
0 Kudos
rahul_p1
Staff
Staff

Created on ‎10-12-2024 03:04 AM

HI, Can you please share the local, remote, and DMZ subnets you have?

Please share the below outputs:- 

 

#get router info routing-table details remote IP addresses

 

diag sniffer packet any 'Host X.X.X.X' 6 0 l  -------->>x.x.x.x is [Remote IP]

diagnose debug reset
diagnose debug flow trace stop
diagnose debug flow filter clear
diagnose debug flow filter addr X.X.X.X
diagnose debug flow show function-name enable
diagnose debug console timestamp enable
diagnose debug flow trace start 1000
diagnose debug enable

 

Run this to stop the debug

diagnose debug disable 

 

 

490
Sulwan_Suliman
New Contributor
In response to rahul_p1

Created on ‎10-14-2024 07:50 PM

Hi below are the details and result:

 

Local: 10.0.20.0/23, 10.0.100.0/23, 10.0.110.0/23
Remote: 10.50.20.0/24
DMZ: 10.10.10.0/24

# diag sniffer packet any 'Host 10.50.20.10' 6 0 l
interfaces=[any]
filters=[Host 10.50.20.10]
pcap_compile: can't parse filter expression: syntax error

SMD-CRP-FW01 # diagnose debug reset

SMD-CRP-FW01 # diagnose debug flow trace stop

SMD-CRP-FW01 # diagnose debug flow filter clear

SMD-CRP-FW01 # diagnose debug flow filter addr 10.50.20.10

SMD-CRP-FW01 # diagnose debug flow show function-name enable
show function name

SMD-CRP-FW01 # diagnose debug console timestamp enable

SMD-CRP-FW01 # diagnose debug flow trace start 100000

SMD-CRP-FW01 # diagnose debug enable

SMD-CRP-FW01 # 2024-10-15 10:47:21 id=65308 trace_id=36 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=46."
2024-10-15 10:47:21 id=65308 trace_id=36 func=init_ip_session_common line=6063 msg="allocate a new session-04ada894"
2024-10-15 10:47:21 id=65308 trace_id=36 func=vf_ip_route_input_common line=2612 msg="find a route: flag=04000000 gw-103.186.161.230 via To SDeCloud"
2024-10-15 10:47:21 id=65308 trace_id=36 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=39, len=4"
2024-10-15 10:47:21 id=65308 trace_id=36 func=get_new_addr line=1265 msg="find SNAT: IP-10.10.10.1(from IPPOOL), port-60418"
2024-10-15 10:47:21 id=65308 trace_id=36 func=fw_forward_handler line=987 msg="Allowed by Policy-4: SNAT"
2024-10-15 10:47:21 id=65308 trace_id=36 func=ids_receive line=464 msg="send to ips"
2024-10-15 10:47:21 id=65308 trace_id=36 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:21 id=65308 trace_id=36 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=0.0.0.0"
2024-10-15 10:47:21 id=65308 trace_id=36 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:21 id=65308 trace_id=36 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:21 id=65308 trace_id=36 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:21 id=65308 trace_id=37 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=46."
2024-10-15 10:47:21 id=65308 trace_id=37 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:21 id=65308 trace_id=37 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:21 id=65308 trace_id=37 func=vf_ip_route_input_common line=2612 msg="find a route: flag=00000000 gw-10.0.20.35 via General WiFi"
2024-10-15 10:47:21 id=65308 trace_id=37 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000000 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:21 id=65308 trace_id=37 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:22 id=65308 trace_id=38 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=47."
2024-10-15 10:47:22 id=65308 trace_id=38 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, original direction"
2024-10-15 10:47:22 id=65308 trace_id=38 func=npu_handle_session44 line=1224 msg="Trying to offloading session from General WiFi to To SDeCloud, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x01041008"
2024-10-15 10:47:22 id=65308 trace_id=38 func=fw_forward_dirty_handler line=442 msg="state=00000204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:22 id=65308 trace_id=38 func=ip_session_core_in line=6563 msg="dir-0, tun_id=103.186.161.230"
2024-10-15 10:47:22 id=65308 trace_id=38 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:22 id=65308 trace_id=38 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=103.186.161.230"
2024-10-15 10:47:22 id=65308 trace_id=38 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:22 id=65308 trace_id=38 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:22 id=65308 trace_id=38 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:22 id=65308 trace_id=39 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=47."
2024-10-15 10:47:22 id=65308 trace_id=39 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:22 id=65308 trace_id=39 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:22 id=65308 trace_id=39 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:22 id=65308 trace_id=39 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:23 id=65308 trace_id=40 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=48."
2024-10-15 10:47:23 id=65308 trace_id=40 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, original direction"
2024-10-15 10:47:23 id=65308 trace_id=40 func=npu_handle_session44 line=1224 msg="Trying to offloading session from General WiFi to To SDeCloud, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x01041008"
2024-10-15 10:47:23 id=65308 trace_id=40 func=fw_forward_dirty_handler line=442 msg="state=00000204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:23 id=65308 trace_id=40 func=ip_session_core_in line=6563 msg="dir-0, tun_id=103.186.161.230"
2024-10-15 10:47:23 id=65308 trace_id=40 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:23 id=65308 trace_id=40 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=103.186.161.230"
2024-10-15 10:47:23 id=65308 trace_id=40 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:23 id=65308 trace_id=40 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:23 id=65308 trace_id=40 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:23 id=65308 trace_id=41 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=48."
2024-10-15 10:47:23 id=65308 trace_id=41 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:23 id=65308 trace_id=41 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:23 id=65308 trace_id=41 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:23 id=65308 trace_id=41 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:24 id=65308 trace_id=42 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=49."
2024-10-15 10:47:24 id=65308 trace_id=42 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, original direction"
2024-10-15 10:47:24 id=65308 trace_id=42 func=npu_handle_session44 line=1224 msg="Trying to offloading session from General WiFi to To SDeCloud, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x01041008"
2024-10-15 10:47:24 id=65308 trace_id=42 func=fw_forward_dirty_handler line=442 msg="state=00000204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:24 id=65308 trace_id=42 func=ip_session_core_in line=6563 msg="dir-0, tun_id=103.186.161.230"
2024-10-15 10:47:24 id=65308 trace_id=42 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:24 id=65308 trace_id=42 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=103.186.161.230"
2024-10-15 10:47:24 id=65308 trace_id=42 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:24 id=65308 trace_id=42 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:24 id=65308 trace_id=42 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:24 id=65308 trace_id=43 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=49."
2024-10-15 10:47:24 id=65308 trace_id=43 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:24 id=65308 trace_id=43 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:24 id=65308 trace_id=43 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:24 id=65308 trace_id=43 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"



415
0 Kudos
dbhavsar
Staff
Staff

Created on ‎10-15-2024 04:53 AM

Good day @Sulwan_Suliman ,

 

- Thanks for the debugs, can you please check if you have any VIP configured I see the traffic is being DNATed. if you have it configured you can limit it to specific interface.

DNB
368
Sulwan_Suliman
New Contributor
In response to dbhavsar

Created on ‎10-15-2024 07:24 PM

Hi,

 

I did not configure any VIP on the Fortigate. I also not sure where this segment 10.10.10.1 coming from. I have tried disable the DMZ port on the firewall, but still I need to add the 10.10.10.0/24 for the local able to ping on the remote site.

Any other advice? Maybe I miss out something? I have check all the routing, vlan in my Fortigate also my switch that connected to this firewall none of it I have declare this 10.10.10.1 segment.

332
0 Kudos
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors
View all
Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Social Media
Security Research
Company
News & Articles
Contact Us

Copyright 2024 Fortinet, Inc. All Rights Reserved.