Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
JoSy
New Contributor

IPSEC tunnel traffic issue

Situation:

We have a site2multi-site situation. The main site A 10.10.0.x and secundary site B 10.10.16.x .

Printer 10.10.16.230 directly connected to the firewall.

Site2site with IPSEC vpn tunnel

 

Policy:

Site A -> Site B allow any

Site B -> Site A allow any

No antivirus or anything enabled

 

Problem:

When we try to surf to a printer or switch webconfig page from A -> B the browser shows http://10.10.16.230/index.html  but it keeps loading. @Site B we can browse perfectly fine to the webconfig.

 

Noticed:

- Ping works in both ways

- RDP works from B-> A if we disable IPV4-Offload (NIC computer)

- DNS server @site A, so the client computers @siteB can surf without any issue through dns server(A)

- Other sites are not having this issue

- The printer cannot send mail from site B -> Mailserver Site A

 

Already tried:

- Remove ipsec tunnel and created a new one

- rebooted firewall @siteB

- disabled/enabled auto-asic on all policy's (A + B)

 

Does anyone have a clue what this could be? We dont know where to look

1 Solution
Toshi_Esumi

I took your statement,

"- Other sites are not having this issue"

as other sites have similar printers and accessing it from site A doesn't show problems, nor printer's email server access at site A.

I would verify no MTU issues inbetween A and B by pinging FGT-to-FGT outside the tunnel and inside with more than 1500bytes packets. Then run flow debug as emnoc suggested.

View solution in original post

3 REPLIES 3
emnoc
Esteemed Contributor III

The cl-cmd diag debug flow  is your best friend but it sounds like it's not the firewall. I would ensure the  proper network mask and gateway on the printer.

 

 

Ken

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Toshi_Esumi

I took your statement,

"- Other sites are not having this issue"

as other sites have similar printers and accessing it from site A doesn't show problems, nor printer's email server access at site A.

I would verify no MTU issues inbetween A and B by pinging FGT-to-FGT outside the tunnel and inside with more than 1500bytes packets. Then run flow debug as emnoc suggested.

JoSy
New Contributor

The MTU was the problem! After lowering it, the problem was solved!

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors