IPSec VPN ¿Routing? Problem.

[#1]

Hi all, I have a VPN configured on a cluster of 110C. The Lan network is 192.168.1.0/24 and the VPN Network 10.0.0.0/24. I can connect and ping to computers in the lan via the VPN. I have other networks configured in the routing table of the Fortigates like: 192.168.3.0/24 gateway 192.168.1.100 If i try to ping 192.168.3.11 for example I see with ' diagnose sniffer packet ' host 192.168.3.11' 4' that my request go and a response returns to the fortigates but never reaches my computer. The firewall rule for the VPN is Port1-All to WAN1-All. Whats wrong with my setup?? Thanks in advance.

[rwpatterson]

Is the tunnel configured in policy mode (action=IPSEC) or route mode (interface mode)?

[#3]

Is in Policy mode.

[rwpatterson]

The problem here is that the 192.168.3.x network is not local to that hub FGT. The default route is where the return traffic is trying to go. The only way around this is to create that tunnel in interface mode. This way you can manually assign static routes to get traffic flowing in the direction you want.

[#5]

I dont understand why the traffic is going by the default route...the problem is that the packets that come back to the fortigate dont go by the VPN.... The VPN have a 10.0.0.0/24 network and I can go to the local networks of the fortigates...¿10.0.0.0/24 is not considered local? So, If I reconfigure the VPN I should config a Static route for the interface of the VPN??

[#6]

@rwpatterson The VPN is now in Interface mode but the problem persist.... The firmware is v4.0,build0194,100121 (MR1 Patch 3) so I´m considering updating to the MR1 Patch 4.

[rwpatterson]

Let' s start from the beginning: What' s the network you are pinging from? Where are you pinging to? I see the interfaces from your above posts.

[#8]

Ok. VPN Lan: 10.0.0.0/24, My IP es 10.0.0.1/24 Local Lan (Port1): 192.168.1.0/24, Fortigate IP 192.168.1.2/24 Gateway to remote Lan: 192.168.1.5/24 Remote Lan: 192.168.3.11/24 I have a static route to 192.168.3.0/24 via 192.168.1.5/24 If I ping: from 10.0.0.1 to 192.168.1.2 Ok. from 10.0.0.1 to 192.168.1.5 Ok. from 192.168.1.2 to 192.168.3.11 Ok. from 10.0.0.1 to 192.168.3.11 Fail. Like I said before with diagnose sniffer packet port1 ' host 10.0.0.1' y see replys coming back from 192.168.3.11 to 10.0.0.1.

[rwpatterson]

Is this a multi-homed network? (The VPN gateway resides on the LAN)