IPSEC VPN Local cannot reach/ping Remote site without including DMZ segment

[Sulwan_Suliman]

Hi, I have an issue where I create an IPSEC Tunnel to a Cloud server, the tunnel is up but local LAN cannot reach and ping to remote site. After checking the traffic, somehow the traffic is going through the DMZ interface which we currently not using and down. After we add the DMZ IP segment to local address on FortiGate, and add to remote on the Remote cloud, we can reach and ping between the sites. I want to know why it still going through DMZ IP segment even though we are not using the DMZ port and it currently down? Our device is Fortigate 100F, version 7.4.4

[dbhavsar]

Hello @Sulwan_Suliman,

- What is the destination subnet you are trying to reach and what is the subnet you are using in DMZ?

[Sulwan_Suliman]

Hi, my destination subnet is 10.50.20.0/24 and the DMZ is 10.10.10.1/24. However as I mentioned, this DMZ is currently down as we are not using it.

[Shashwati]

Hello 

Please run packet capture and debug while testing the connection 

diag sniffer packet any 'Host X.X.X.X' 6 0 l   [Remote IP]

diagnose debug reset
diagnose debug flow trace stop
diagnose debug flow filter clear
diagnose debug flow filter addr X.X.X.X
diagnose debug flow show function-name enable
diagnose debug console timestamp enable
diagnose debug flow trace start 100000
diagnose debug enable

Run this to stop the debug

diagnose debug disable 

[Sulwan_Suliman]

Hi, below is the result:

# diag sniffer packet any 'Host 10.50.20.10' 6 0 l
interfaces=[any]
filters=[Host 10.50.20.10]
pcap_compile: can't parse filter expression: syntax error

SMD-CRP-FW01 # diagnose debug reset

SMD-CRP-FW01 # diagnose debug flow trace stop

SMD-CRP-FW01 # diagnose debug flow filter clear

SMD-CRP-FW01 # diagnose debug flow filter addr 10.50.20.10

SMD-CRP-FW01 # diagnose debug flow show function-name enable
show function name

SMD-CRP-FW01 # diagnose debug console timestamp enable

SMD-CRP-FW01 # diagnose debug flow trace start 100000

SMD-CRP-FW01 # diagnose debug enable

SMD-CRP-FW01 # 2024-10-15 10:47:21 id=65308 trace_id=36 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=46."
2024-10-15 10:47:21 id=65308 trace_id=36 func=init_ip_session_common line=6063 msg="allocate a new session-04ada894"
2024-10-15 10:47:21 id=65308 trace_id=36 func=vf_ip_route_input_common line=2612 msg="find a route: flag=04000000 gw-103.186.161.230 via To SDeCloud"
2024-10-15 10:47:21 id=65308 trace_id=36 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=39, len=4"
2024-10-15 10:47:21 id=65308 trace_id=36 func=get_new_addr line=1265 msg="find SNAT: IP-10.10.10.1(from IPPOOL), port-60418"
2024-10-15 10:47:21 id=65308 trace_id=36 func=fw_forward_handler line=987 msg="Allowed by Policy-4: SNAT"
2024-10-15 10:47:21 id=65308 trace_id=36 func=ids_receive line=464 msg="send to ips"
2024-10-15 10:47:21 id=65308 trace_id=36 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:21 id=65308 trace_id=36 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=0.0.0.0"
2024-10-15 10:47:21 id=65308 trace_id=36 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:21 id=65308 trace_id=36 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:21 id=65308 trace_id=36 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:21 id=65308 trace_id=37 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=46."
2024-10-15 10:47:21 id=65308 trace_id=37 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:21 id=65308 trace_id=37 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:21 id=65308 trace_id=37 func=vf_ip_route_input_common line=2612 msg="find a route: flag=00000000 gw-10.0.20.35 via General WiFi"
2024-10-15 10:47:21 id=65308 trace_id=37 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000000 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:21 id=65308 trace_id=37 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:22 id=65308 trace_id=38 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=47."
2024-10-15 10:47:22 id=65308 trace_id=38 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, original direction"
2024-10-15 10:47:22 id=65308 trace_id=38 func=npu_handle_session44 line=1224 msg="Trying to offloading session from General WiFi to To SDeCloud, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x01041008"
2024-10-15 10:47:22 id=65308 trace_id=38 func=fw_forward_dirty_handler line=442 msg="state=00000204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:22 id=65308 trace_id=38 func=ip_session_core_in line=6563 msg="dir-0, tun_id=103.186.161.230"
2024-10-15 10:47:22 id=65308 trace_id=38 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:22 id=65308 trace_id=38 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=103.186.161.230"
2024-10-15 10:47:22 id=65308 trace_id=38 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:22 id=65308 trace_id=38 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:22 id=65308 trace_id=38 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:22 id=65308 trace_id=39 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=47."
2024-10-15 10:47:22 id=65308 trace_id=39 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:22 id=65308 trace_id=39 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:22 id=65308 trace_id=39 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:22 id=65308 trace_id=39 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:23 id=65308 trace_id=40 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=48."
2024-10-15 10:47:23 id=65308 trace_id=40 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, original direction"
2024-10-15 10:47:23 id=65308 trace_id=40 func=npu_handle_session44 line=1224 msg="Trying to offloading session from General WiFi to To SDeCloud, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x01041008"
2024-10-15 10:47:23 id=65308 trace_id=40 func=fw_forward_dirty_handler line=442 msg="state=00000204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:23 id=65308 trace_id=40 func=ip_session_core_in line=6563 msg="dir-0, tun_id=103.186.161.230"
2024-10-15 10:47:23 id=65308 trace_id=40 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:23 id=65308 trace_id=40 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=103.186.161.230"
2024-10-15 10:47:23 id=65308 trace_id=40 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:23 id=65308 trace_id=40 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:23 id=65308 trace_id=40 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:23 id=65308 trace_id=41 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=48."
2024-10-15 10:47:23 id=65308 trace_id=41 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:23 id=65308 trace_id=41 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:23 id=65308 trace_id=41 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:23 id=65308 trace_id=41 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:24 id=65308 trace_id=42 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=49."
2024-10-15 10:47:24 id=65308 trace_id=42 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, original direction"
2024-10-15 10:47:24 id=65308 trace_id=42 func=npu_handle_session44 line=1224 msg="Trying to offloading session from General WiFi to To SDeCloud, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x01041008"
2024-10-15 10:47:24 id=65308 trace_id=42 func=fw_forward_dirty_handler line=442 msg="state=00000204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:24 id=65308 trace_id=42 func=ip_session_core_in line=6563 msg="dir-0, tun_id=103.186.161.230"
2024-10-15 10:47:24 id=65308 trace_id=42 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:24 id=65308 trace_id=42 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=103.186.161.230"
2024-10-15 10:47:24 id=65308 trace_id=42 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:24 id=65308 trace_id=42 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:24 id=65308 trace_id=42 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:24 id=65308 trace_id=43 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=49."
2024-10-15 10:47:24 id=65308 trace_id=43 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:24 id=65308 trace_id=43 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:24 id=65308 trace_id=43 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:24 id=65308 trace_id=43 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"

[rahul_p1]

HI, Can you please share the local, remote, and DMZ subnets you have?

Please share the below outputs:- 

#get router info routing-table details remote IP addresses

diag sniffer packet any 'Host X.X.X.X' 6 0 l  -------->>x.x.x.x is [Remote IP]

diagnose debug reset
diagnose debug flow trace stop
diagnose debug flow filter clear
diagnose debug flow filter addr X.X.X.X
diagnose debug flow show function-name enable
diagnose debug console timestamp enable
diagnose debug flow trace start 1000
diagnose debug enable

Run this to stop the debug

diagnose debug disable 

[Sulwan_Suliman]

Hi below are the details and result:

Local: 10.0.20.0/23, 10.0.100.0/23, 10.0.110.0/23
Remote: 10.50.20.0/24
DMZ: 10.10.10.0/24

# diag sniffer packet any 'Host 10.50.20.10' 6 0 l
interfaces=[any]
filters=[Host 10.50.20.10]
pcap_compile: can't parse filter expression: syntax error

SMD-CRP-FW01 # diagnose debug reset

SMD-CRP-FW01 # diagnose debug flow trace stop

SMD-CRP-FW01 # diagnose debug flow filter clear

SMD-CRP-FW01 # diagnose debug flow filter addr 10.50.20.10

SMD-CRP-FW01 # diagnose debug flow show function-name enable
show function name

SMD-CRP-FW01 # diagnose debug console timestamp enable

SMD-CRP-FW01 # diagnose debug flow trace start 100000

SMD-CRP-FW01 # diagnose debug enable

SMD-CRP-FW01 # 2024-10-15 10:47:21 id=65308 trace_id=36 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=46."
2024-10-15 10:47:21 id=65308 trace_id=36 func=init_ip_session_common line=6063 msg="allocate a new session-04ada894"
2024-10-15 10:47:21 id=65308 trace_id=36 func=vf_ip_route_input_common line=2612 msg="find a route: flag=04000000 gw-103.186.161.230 via To SDeCloud"
2024-10-15 10:47:21 id=65308 trace_id=36 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=39, len=4"
2024-10-15 10:47:21 id=65308 trace_id=36 func=get_new_addr line=1265 msg="find SNAT: IP-10.10.10.1(from IPPOOL), port-60418"
2024-10-15 10:47:21 id=65308 trace_id=36 func=fw_forward_handler line=987 msg="Allowed by Policy-4: SNAT"
2024-10-15 10:47:21 id=65308 trace_id=36 func=ids_receive line=464 msg="send to ips"
2024-10-15 10:47:21 id=65308 trace_id=36 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:21 id=65308 trace_id=36 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=0.0.0.0"
2024-10-15 10:47:21 id=65308 trace_id=36 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:21 id=65308 trace_id=36 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:21 id=65308 trace_id=36 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:21 id=65308 trace_id=37 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=46."
2024-10-15 10:47:21 id=65308 trace_id=37 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:21 id=65308 trace_id=37 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:21 id=65308 trace_id=37 func=vf_ip_route_input_common line=2612 msg="find a route: flag=00000000 gw-10.0.20.35 via General WiFi"
2024-10-15 10:47:21 id=65308 trace_id=37 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000000 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:21 id=65308 trace_id=37 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:22 id=65308 trace_id=38 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=47."
2024-10-15 10:47:22 id=65308 trace_id=38 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, original direction"
2024-10-15 10:47:22 id=65308 trace_id=38 func=npu_handle_session44 line=1224 msg="Trying to offloading session from General WiFi to To SDeCloud, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x01041008"
2024-10-15 10:47:22 id=65308 trace_id=38 func=fw_forward_dirty_handler line=442 msg="state=00000204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:22 id=65308 trace_id=38 func=ip_session_core_in line=6563 msg="dir-0, tun_id=103.186.161.230"
2024-10-15 10:47:22 id=65308 trace_id=38 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:22 id=65308 trace_id=38 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=103.186.161.230"
2024-10-15 10:47:22 id=65308 trace_id=38 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:22 id=65308 trace_id=38 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:22 id=65308 trace_id=38 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:22 id=65308 trace_id=39 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=47."
2024-10-15 10:47:22 id=65308 trace_id=39 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:22 id=65308 trace_id=39 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:22 id=65308 trace_id=39 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:22 id=65308 trace_id=39 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:23 id=65308 trace_id=40 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=48."
2024-10-15 10:47:23 id=65308 trace_id=40 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, original direction"
2024-10-15 10:47:23 id=65308 trace_id=40 func=npu_handle_session44 line=1224 msg="Trying to offloading session from General WiFi to To SDeCloud, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x01041008"
2024-10-15 10:47:23 id=65308 trace_id=40 func=fw_forward_dirty_handler line=442 msg="state=00000204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:23 id=65308 trace_id=40 func=ip_session_core_in line=6563 msg="dir-0, tun_id=103.186.161.230"
2024-10-15 10:47:23 id=65308 trace_id=40 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:23 id=65308 trace_id=40 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=103.186.161.230"
2024-10-15 10:47:23 id=65308 trace_id=40 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:23 id=65308 trace_id=40 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:23 id=65308 trace_id=40 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:23 id=65308 trace_id=41 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=48."
2024-10-15 10:47:23 id=65308 trace_id=41 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:23 id=65308 trace_id=41 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:23 id=65308 trace_id=41 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:23 id=65308 trace_id=41 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:24 id=65308 trace_id=42 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.0.20.35:1->10.50.20.10:2048) tun_id=0.0.0.0 from General WiFi. type=8, code=0, id=1, seq=49."
2024-10-15 10:47:24 id=65308 trace_id=42 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, original direction"
2024-10-15 10:47:24 id=65308 trace_id=42 func=npu_handle_session44 line=1224 msg="Trying to offloading session from General WiFi to To SDeCloud, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x01041008"
2024-10-15 10:47:24 id=65308 trace_id=42 func=fw_forward_dirty_handler line=442 msg="state=00000204, state2=00000001, npu_state=01041008"
2024-10-15 10:47:24 id=65308 trace_id=42 func=ip_session_core_in line=6563 msg="dir-0, tun_id=103.186.161.230"
2024-10-15 10:47:24 id=65308 trace_id=42 func=__ip_session_run_tuple line=3429 msg="SNAT 10.0.20.35->10.10.10.1:60418"
2024-10-15 10:47:24 id=65308 trace_id=42 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface To SDeCloud, tun_id=103.186.161.230"
2024-10-15 10:47:24 id=65308 trace_id=42 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel To SDeCloud, tun_id=103.186.161.230, vrf 0"
2024-10-15 10:47:24 id=65308 trace_id=42 func=esp_output4 line=876 msg="IPsec encrypt/auth"
2024-10-15 10:47:24 id=65308 trace_id=42 func=ipsec_output_finish line=666 msg="send to 10.115.0.1 via intf-ppp2"
2024-10-15 10:47:24 id=65308 trace_id=43 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.50.20.10:60418->10.10.10.1:0) tun_id=103.186.161.230 from To SDeCloud. type=0, code=0, id=60418, seq=49."
2024-10-15 10:47:24 id=65308 trace_id=43 func=resolve_ip_tuple_fast line=5967 msg="Find an existing session, id-04ada894, reply direction"
2024-10-15 10:47:24 id=65308 trace_id=43 func=__ip_session_run_tuple line=3442 msg="DNAT 10.10.10.1:0->10.0.20.35:1"
2024-10-15 10:47:24 id=65308 trace_id=43 func=npu_handle_session44 line=1224 msg="Trying to offloading session from To SDeCloud to General WiFi, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x01041008"
2024-10-15 10:47:24 id=65308 trace_id=43 func=fw_forward_dirty_handler line=442 msg="state=00010204, state2=00000001, npu_state=01041008"

[dbhavsar]

Good day @Sulwan_Suliman ,

- Thanks for the debugs, can you please check if you have any VIP configured I see the traffic is being DNATed. if you have it configured you can limit it to specific interface.

[Sulwan_Suliman]

Hi,

I did not configure any VIP on the Fortigate. I also not sure where this segment 10.10.10.1 coming from. I have tried disable the DMZ port on the firewall, but still I need to add the 10.10.10.0/24 for the local able to ping on the remote site.

Any other advice? Maybe I miss out something? I have check all the routing, vlan in my Fortigate also my switch that connected to this firewall none of it I have declare this 10.10.10.1 segment.