IPSEC VPN tunnel up but no Data from the other side

[#1]

Hello together, i have a customer with a Fortigate 60b conneting via Side-to-Side VPN to a Cisco PIX The firmware version of the Fortigate-60B is 3.00-b0741(MR7 Patch 5) We already tried the 4.0.2 but we have a lot of trouble with this version (not only VPN) and switched back to 3.0 The Tunnel is UP and shows green at the Fortigate VPN Monitor The Network looks like:

 customer-Network:                                                           Partner-network:
 10.10.0.0/24-----Fortigate-(WANIP: AAA.BBB.CCC.238)---------INTERNET--------(WANIP: XXX.YYY.ZZZ.139)-Cisco PIX----10.0.1.0/24----translated to: 10.2.12.0/24
 

the AAA.BBB.CCC.233 is the gateway of the fortigate The Tunnel comes up but there is no traffic transmittet trough the tunnel We pinged from the internel server (10.10.0.32) to the remote Server (10.0.1.13) i see the packets on the fortigate (see debug flow protokoll) but i don´t see any reply i also see the packets with the sniffer (see sniffer protokoll) but still no reply The remote admin see the packets from me comming in and answered by his mashine (see remote side protokoll) but i don´t see this packets on my side comming back again. Fortigate IPSEC-P1 config:

 config vpn ipsec phase1-interface
     edit " IPSEC-P1-Emsys" 
         set interface " wan1" 
         set dhgrp 2
         set proposal 3des-sha1
         set keylife 86400
         set remote-gw xxx.yyy.zzz.139
         set psksecret ENC <shared-secret>
     next
 end
 

Fortigate IPSEC-P2 config:

 config vpn ipsec phase2-interface
     edit " IPSEC-P2-Emsys" 
         set dhgrp 2
         set keepalive enable
         set pfs enable
         set phase1name " IPSEC-P1-Emsys" 
         set proposal 3des-sha1
         set dst-subnet 10.0.1.0 255.255.255.0
         set keylifeseconds 3600
         set src-subnet 10.10.0.0 255.255.0.0
     next
 end
 

Fortigate Firewall policies: Incoming policy

 config firewall policy
     edit 15
         set srcintf " IPSEC-P1-Emsys" 
         set dstintf " internal" 
             set srcaddr " Emsys-Netzwerk" 
             set dstaddr " Appl-Intranet" 
         set action accept
         set schedule " always" 
             set service " ANY" 
     next
 end
 

outgoing policy

 config firewall policy
     edit 16
         set srcintf " internal" 
         set dstintf " IPSEC-P1-Emsys" 
             set srcaddr " Appl-Intranet" 
             set dstaddr " Emsys-Netzwerk" 
         set action accept
         set schedule " always" 
             set service " ANY" 
     next
 end
 

Fortigate Addresses:

 config firewall address
     edit " Appl-Intranet" 
         set associated-interface " internal" 
         set subnet 10.10.0.0 255.255.0.0
     next
 end
 config firewall address
     edit " Emsys-Netzwerk" 
         set associated-interface " IPSEC-P1-Emsys" 
         set subnet 10.0.1.0 255.255.255.0
     next
 end
 

Fortigate debug flow protokoll:

 FGT60B3908660513 # diagnose debug flow trace start 2
 
 FGT60B3908660513 # id=20085 trace_id=1681 func=resolve_ip_tuple_fast line=2810 msg=" vd-root received a packet(proto=1, 10.10.0.32:5912->10.0.1.13:8) from internal." 
 id=20085 trace_id=1681 func=resolve_ip_tuple_fast line=2837 msg=" Find an existing session, id-00211841, original direction" 
 id=20085 trace_id=1681 func=ipv4_fast_cb line=57 msg=" enter fast path" 
 id=20085 trace_id=1681 func=ipsecdev_hard_start_xmit line=122 msg=" enter IPsec interface-IPSEC-P1-Emsys" 
 id=20085 trace_id=1681 func=esp_output4 line=467 msg=" encrypted, and send to xxx.yyy.zzz.139 with source AAA.BBB.CCC.238" 
 id=20085 trace_id=1681 func=ipsec_output_finish line=133 msg=" send to AAA.BBB.CCC.233 via intf-wan1" 
 
 id=20085 trace_id=1682 func=resolve_ip_tuple_fast line=2810 msg=" vd-root received a packet(proto=1, 10.10.0.32:5912->10.0.1.13:8) from internal." 
 id=20085 trace_id=1682 func=resolve_ip_tuple_fast line=2837 msg=" Find an existing session, id-00211841, original direction" 
 id=20085 trace_id=1682 func=ipv4_fast_cb line=57 msg=" enter fast path" 
 id=20085 trace_id=1682 func=ipsecdev_hard_start_xmit line=122 msg=" enter IPsec interface-IPSEC-P1-Emsys" 
 id=20085 trace_id=1682 func=esp_output4 line=467 msg=" encrypted, and send to xxx.yyy.zzz.139 with source AAA.BBB.CCC.238" 
 id=20085 trace_id=1682 func=ipsec_output_finish line=133 msg=" send to AAA.BBB.CCC.233 via intf-wan1" 
 

Fortigate Sniffer protokoll:

 FGT60B3908660513 # diagnose sniffer packet any ' host 10.0.1.13'  3
 interfaces=[any]
 filters=[host 10.0.1.13]
 1.302700 10.10.0.32 -> 10.0.1.13: icmp: echo request
 0x0000   0000 0000 0001 000c 2945 cff6 0800 4500        ........)E....E.
 0x0010   0054 0000 4000 4001 2573 0a0a 0020 0a00        .T..@.@.%s......
 0x0020   010d 0800 4953 1718 2ab2 e6c4 414a 55d0        ....IS..*...AJU.
 0x0030   0400 0809 0a0b 0c0d 0e0f 1011 1213 1415        ................
 0x0040   1617 1819 1a1b 1c1d 1e1f 2021 2223 2425        ...........!" #$%
 0x0050   2627 2829 2a2b 2c2d 2e2f 3031 3233 3435        &' ()*+,-./012345
 0x0060   3637                                           67
 
 1.302740 10.10.0.32 -> 10.0.1.13: icmp: echo request
 0x0000   0000 0000 0000 0000 0000 0000 0800 4500        ..............E.
 0x0010   0054 0000 4000 3f01 2673 0a0a 0020 0a00        .T..@.?.&s......
 0x0020   010d 0800 4953 1718 2ab2 e6c4 414a 55d0        ....IS..*...AJU.
 0x0030   0400 0809 0a0b 0c0d 0e0f 1011 1213 1415        ................
 0x0040   1617 1819 1a1b 1c1d 1e1f 2021 2223 2425        ...........!" #$%
 0x0050   2627 2829 2a2b 2c2d 2e2f 3031 3233 3435        &' ()*+,-./012345
 0x0060   3637                                           67
 
 2.329639 10.10.0.32 -> 10.0.1.13: icmp: echo request
 0x0000   0000 0000 0001 000c 2945 cff6 0800 4500        ........)E....E.
 0x0010   0054 0000 4000 4001 2573 0a0a 0020 0a00        .T..@.@.%s......
 0x0020   010d 0800 0f4f 1718 2ab3 e7c4 414a 8ed3        .....O..*...AJ..
 0x0030   0400 0809 0a0b 0c0d 0e0f 1011 1213 1415        ................
 0x0040   1617 1819 1a1b 1c1d 1e1f 2021 2223 2425        ...........!" #$%
 0x0050   2627 2829 2a2b 2c2d 2e2f 3031 3233 3435        &' ()*+,-./012345
 0x0060   3637                                    
 

Remote Side Cisco protokoll:

 ICMP echo-request from outside:10.10.0.32 to 10.0.1.13 ID=5912 seq=1780 length=64
 3361: ICMP echo-request: translating outside:10.10.0.32 to inside:10.2.12.11
 3362: ICMP echo-reply from inside:10.0.1.13 to 10.2.12.11 ID=5912 seq=1780 length=64
 3363: ICMP echo-reply: untranslating inside:10.2.12.11 to outside:10.10.0.32
 

Any idee what problem we have ?

[#2]

first thank you severach for the work i did not tried the policy based vpn route until now but i know that there is another interface based vpn tunnel from another customer to the same cisco pix and this tunnel works and a second thing is that i never have had so much trouble with a fortigate VPN tunnel before. we run more than 50 vpn interface tunnels with different ftg-models to many different firewalls on the remote side so i cannot say that the v3.00 is realy buggy i never experienced such problems before. i will try the policy based VPN and let you know if it works thx