IPSec VPN Clients Accessing Remote Subnets across Site to Site VPN

[robert_espi]

Hi Guys, 
Hoping someone can help.
I have Site to Site VPN established between two sites. Site A and Site B.
Site A IPSec VPN Subnet - 10.10.10.1.0/24 | Site B Local LAN Subnet 192.168.1.0/24
I want Site A IPsec VPN Clients to access resources hosted on Site B, which are connected thru STS VPN.
1.) I've already created static routes between Site A and Site B Subnets on both FG.

2.)I already have Policies established to allow Site A VPN Subnet access to Site B Local Subnet.

3.) I also have included both subnets in their respective Phase 2 selectors. 

I ran a ping test from Site A VPN to Site B subnet , and was only able to ping its gateway 192.168.1.1.

Not sure as to what more i must include in order to establish connection to the rest of 192.168.1.0/24.

 Feel free to chime in thoughts. Thanks in advance.

*Note that the two FG are connected using different IP addressed in the same Public IP Block xxx.xxx.x.x/29..not sure if that would cause any issues. 

[sagha]

Hi robert_espi, 

You can run debug flows and check how FGT is dealing with traffic. 

diag de flow filter addr x.x.x.x

diag de flow filter proto 1

diag de flow trace start 100 

diag de en

Replace x.x.x.x with the destination address.

After that, ping the destination again. You can share the debugs here and we can have a look then. 

Thank you. 

Shahan Agha

[robert_espi]

FGT90D-IMM # exec ping 192.168.1.6
id=20085 trace_id=21 func=print_pkt_detail line=5455 msg="vd-root received a packet(proto=1, 222.22.222.2.:19265->192.168.1.6:2048) from local. type=8, code=0, id=19265, seq=0."
id=20085 trace_id=21 func=init_ip_session_common line=5619 msg="allocate a new session-073c1460"
id=20085 trace_id=21 func=ipsecdev_hard_start_xmit line=631 msg="enter IPsec interface-TO-Remote"
id=20085 trace_id=21 func=ipsec_common_output4 line=801 msg="No matching IPsec selector, drop"
id=20085 trace_id=22 func=print_pkt_detail line=5455 msg="vd-root received a packet(proto=1, 222.22.222.22:19265->192.168.1.6:2048) from local. type=8, code=0, id=19265, seq=1."
id=20085 trace_id=22 func=resolve_ip_tuple_fast line=5535 msg="Find an existing session, id-073c1460, original direction"
id=20085 trace_id=22 func=ipsecdev_hard_start_xmit line=631 msg="enter IPsec interface-TO-Remote"
id=20085 trace_id=22 func=ipsec_common_output4 line=801 msg="No matching IPsec selector, drop"
id=20085 trace_id=23 func=print_pkt_detail line=5455 msg="vd-root received a packet(proto=1, 222.22.222.22:19265->192.168.1.6:2048) from local. type=8, code=0, id=19265, seq=2."
id=20085 trace_id=23 func=resolve_ip_tuple_fast line=5535 msg="Find an existing session, id-073c1460, original direction"
id=20085 trace_id=23 func=ipsecdev_hard_start_xmit line=631 msg="enter IPsec interface-TO-Remote"
id=20085 trace_id=23 func=ipsec_common_output4 line=801 msg="No matching IPsec selector, drop"
id=20085 trace_id=24 func=print_pkt_detail line=5455 msg="vd-root received a packet(proto=1, 222.22.222.22:19265->192.168.1.6:2048) from local. type=8, code=0, id=19265, seq=3."
id=20085 trace_id=24 func=resolve_ip_tuple_fast line=5535 msg="Find an existing session, id-073c1460, original direction"
id=20085 trace_id=24 func=ipsecdev_hard_start_xmit line=631 msg="enter IPsec interface-TO-Remote"
id=20085 trace_id=24 func=ipsec_common_output4 line=801 msg="No matching IPsec selector, drop"
id=20085 trace_id=25 func=print_pkt_detail line=5455 msg="vd-root received a packet(proto=1, 222.22.222.22:19265->192.168.1.6:2048) from local. type=8, code=0, id=19265, seq=4."
id=20085 trace_id=25 func=resolve_ip_tuple_fast line=5535 msg="Find an existing session, id-073c1460, original direction"
id=20085 trace_id=25 func=ipsecdev_hard_start_xmit line=631 msg="enter IPsec interface-TO-Remote"
id=20085 trace_id=25 func=ipsec_common_output4 line=801 msg="No matching IPsec selector, drop"
binding source interface address error.
PING 192.168.1.6 (192.168.1.6): 56 data bytes

--- 192.168.1.6 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss

[akumarr]

Dear Customer.

From the output, I could see that "No matching IPsec selector, drop.
This means the Local/Remote subnet is not matching under Phase2 selectors.
Navigate to IPsec tunnels, edit the tunnels, and under Phase 2 selectors please verify if the Local and remote subnet matches.

From the logs, I could see that the source is 222.22.222.2, and the destination IP is 192.168.1.6.
Please verify and update the IP's accordingly, If you have NAT enabled in the policy then kindly disable it.