IPSec VPN between LAN and DMZ zone

[MadDog_2023]

Hi All,

IPSec VPN is configured this way:

HO: LAN [192.168.7.0/24] - WAN --- IPSEC VPN --- WAN --- DMZ Zone [10.10.10.0/24]: BO

On both ends FortiGate routers.

VPN tunnel is up but traffic doesn't go to\from.

Checked firewall rules - ALL allowed to\from on both ends

Checked static routes - for both 192.168.7.0/24 and 10.10.10.0/24 static routes exist with VPN interfaces as destinations.

Is there anything special about configuring VPN for DMZ Zone?

In the HO IPSec VPN tunnels to other branches works like a charm, but IPSec VPN to the BO in question with LAN in DMZ doesn't work.

I compared IPSec VPN configuration and the only difference is in other branches VPN tunnels connect LAN to LAN and in this case it is LAN to DMZ.

[parteeksharma]

Hi MadDog_2023,
Hope you are doing good.

As I understand, you are facing the issue with traffic passing through IPsec VPN tunnel. To check the issue regarding traffic, please share the below output:

diagnose debug reset

diagnose debug disable

diagnose debug flow show fun en

diagnose debug flow filter clear

diagnose debug flow filter saddr <source IP address>

diagnose debug flow filter daddr <destination IP address>

diagnose debug flow trace start 99

diagnose debug enable

NOTE: Replicate the issue, After 5-10sec, disable the logs by executing:

diagnose debug disable

diagnose debug flow trace stop

Regards,
Parteek

[MadDog_2023]

Hi parteeksharma,

I run the commands.

Could you please advise where can I get output? 

[Rajneesh]

Hi @MadDog_2023 

Run this command on your HO firewall :
Example : diagnose sniffer packet any "host <IP> and icmp" 4 0 l      ------------replace  <IP> with the IP of the end machine from where you are initiating the traffic.
If you are seeing traffic coming on your LAN interface and going out via the ipsec tunnel interface then it means policy is fine and we are sending the packet out.
If not then run the debug flow to find the reason.

Follow the commands shared by @parteeksharma  and share the output.

[MadDog_2023]

I checked IPSec monitor. 

I can incoming data from BO DMZ but can't see outgoing data from HO LAN.

Does that mean the issue is on HO FortiGate side?

[Keerthi_A]

Hi @MadDog_2023 

As I understand, traffic from BO DMZ is received at the HO firewall, but you do not see an outgoing reply/response from HO LAN?

If so collect the debug to see if this traffic is allowed and being forwarded to the HO LAN interface.

If it allowed by right policy and forwarded to LAN interface and you do not see a reply back, validate if the reverse route for the BO subnet available at HO LAN PC/server.

Debug commands:

diagnose debug reset

diagnose debug flow filter clear

diagnose debug flow filter saddr <source IP address>

diagnose debug flow filter daddr <destination IP address>

diagnose debug flow trace start 255

diagnose debug enable

NOTE: Replicate the issue, After 5-10sec, disable the logs by executing:

diagnose debug disable

[MadDog_2023]

Hi Keerthu_A,

After or while I run the suggested commands do I need to generate some traffic from HO to BO or vice versa (for example ping from HO to BO)?

Also, once I run diagnose debug disable where can I see debug output?

[Keerthi_A]

Hi @MadDog_2023,

Run the below debug commands on both ends.

diagnose debug reset

diagnose debug flow filter clear

diagnose debug flow filter saddr <source IP address>

diagnose debug flow filter daddr <destination IP address>

diagnose debug flow trace start 255

diagnose debug enable

once the commands are enabled, genrate the traffic from HO to BO or vice versa(as per your requirement)

once traffic is generated you should see the logs on the cli console/putty

once traffic initiated wait for few seconds and then disable the debug using below command(to stop capturing more logs)

diagnose debug disable

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-a-log-file-of-a-session-usin...

[MadDog_2023]

Hi Keerthi_A

diagnose debug flow filter saddr <source IP address>

diagnose debug flow filter daddr <destination IP address>

For source and destination IP addresses should I put any local addresses from LAn and DMZ or it should be public addresses of both ends? 

[Toshi_Esumi]

192.168.7.x and 10.10.10.y since you said the tunnel was "UP". Then send packets like ping from .x to .y if you're going to run the flow debug on .x side.

Toshi