IPSEC VPN UP But no incoming traffic inside

[Gaetan_237]

IPSEC VPN is UP and traffic was normally going through, without any action we started to no more receive any incoming traffic in the tunnel. No change done on both side. Everything is ok on both side in term of routing and policy

FortiGate 

[syordanov]

Dear Gaetan_237,

Please run the commands bellow :

SSH No1:

diagnose sniffer packet any " host x.x.x.x and host y.y.y.y" 4 0 l ,

where x.x.x.x is the IP address located behind your FortiGate and y.y.y.y is the IP address located behind remote VPN peer.

SSH No2:

diag sys session filter src XXXXX.XXXXX.XXXX.XXXX <---- source IP

diag sys session filter dst XXXXX.XXXXX.XXXX.XXXX <---- destination IP

diag sys session list

SSH No3:

Before starting a new traffic , run the debug below and then start a new traffic :

diagnose debug reset
diagnose debug flow filter saddr XXXXXX <----source IP
diagnose debug flow filter daddr YYYYYY <----destination IP
diag debug flow show function-name enable
diag debug flow show iprope enable
diagnose debug console timestamp enable
diagnose debug flow trace start 999999
diagnose debug enable

Did you test to disable the NP offloading on the FW rule which allows that traffic or offloading on the IPSec?

Could you please check the logs on FortiGate for the affected traffic?

Did you run a diagnose sniffer for the IKE/ESP? If possible try to switch to NAT-T (encapsulating IKE/ESP into UDP 4500) .

Best regards,

Fortinet.