IPSec VPN Connected But cant reach other side

[Iz3k34l]

My equipment is as follows:

US is a 200D running version 5.0

Manila is a 200A running version 5.0

I have the IPSec VPN setup on both ends and communicating with each other, from the US fortigate i can do an execute ping to the manila network and can get a response and vice-versa. but im not able to access either site from the other. Here is the configuration for the policy for that connection.

config firewall policy

    edit 9

        set srcintf "internal"

        set dstintf "wan2"

            set srcaddr "Addison_Lan" 

            set dstaddr "Manila LAN" 

        set action ipsec

        set schedule "always"

            set service "ANY" 

        set logtraffic enable

        set inbound enable

        set outbound enable

        set vpntunnel "Manila"

    next

end

Thanks in advance for your help

[emnoc]

the diag debug flow is your friend.

http://socpuppet.blogspot.com/2013/10/site-2-site-routed-vpn-trouble-shooting.html

I would start by t-shooting the vpn diagnostics to ensure the tunnel is up and encrypting traffic. Also  route-based vpn vrs policy-based give you more option with diagnostics imho, others would disagree, but even fortinet  pushes rt-based vpns.

[Somashekara_Hanumant]

Hi,

By using below command you verify the tunnel is up or not

diag ike vpn gateway list

diag vpn tunnel list

and by using the below commands you can check the traffic is hitting correct tunnel or not

http://kb.fortinet.com/kb...amp;externalId=FD36043 diag debug reset diag debug enable diagnose debug flow filter saddr x.x.x.x

diagnose debug flow filter daddr y.y.y.y diagnose debug flow filter proto 1 diag debug flow show console enable diag debug flow show function-name enable diag debug flow trace start 200

After initiating the above commands on ssh then try to ping destination IP address y.y.y.y from internal source IP address x.x.x.x

You can also run these commands on the other fortigate unit to check whether the packets are reaching or not.

Regards,

Somu