My equipment is as follows:
US is a 200D running version 5.0
Manila is a 200A running version 5.0
I have the IPSec VPN setup on both ends and communicating with each other, from the US fortigate i can do an execute ping to the manila network and can get a response and vice-versa. but im not able to access either site from the other. Here is the configuration for the policy for that connection.
config firewall policy
edit 9
set srcintf "internal"
set dstintf "wan2"
set srcaddr "Addison_Lan"
set dstaddr "Manila LAN"
set action ipsec
set schedule "always"
set service "ANY"
set logtraffic enable
set inbound enable
set outbound enable
set vpntunnel "Manila"
next
end
Thanks in advance for your help
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
the diag debug flow is your friend.
http://socpuppet.blogspot.com/2013/10/site-2-site-routed-vpn-trouble-shooting.html
I would start by t-shooting the vpn diagnostics to ensure the tunnel is up and encrypting traffic. Also route-based vpn vrs policy-based give you more option with diagnostics imho, others would disagree, but even fortinet pushes rt-based vpns.
PCNSE
NSE
StrongSwan
Hi,
By using below command you verify the tunnel is up or not
diag ike vpn gateway list
diag vpn tunnel list
and by using the below commands you can check the traffic is hitting correct tunnel or not
http://kb.fortinet.com/kb...amp;externalId=FD36043 diag debug reset diag debug enable diagnose debug flow filter saddr x.x.x.x
diagnose debug flow filter daddr y.y.y.y diagnose debug flow filter proto 1 diag debug flow show console enable diag debug flow show function-name enable diag debug flow trace start 200
After initiating the above commands on ssh then try to ping destination IP address y.y.y.y from internal source IP address x.x.x.x
You can also run these commands on the other fortigate unit to check whether the packets are reaching or not.
Regards,
Somu
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1634 | |
1063 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.