IPSec client is blocked by implicit deny although allow rule exists

[mhaneke]

Hello,

I created the following rule to allow an IPSec client network aka EMS_IKEv1_F_NB [198.18.27.0/24] to access Intranet aka TRK3  [192.168.0.0/16]. Nevertheless the clients is blocked by the implicit deny rule.

When I try to check the policy using the Policy Match Tool while the client is connected it returns "No route exists from source address 198.18.27.2".

But get router info routing-table details shows

S 198.18.27.2/32 [15/0] via EMS_IKEv1_F_NB tunnel 198.18.27.2, [1/0]

while the client is connected.

FGRO01 (vdom) # edit root
current vf=root:0

CFGRO01 (root) # config firewall policy

CFGRO01 (policy) # edit "32"

CFGRO01 (32) # show
config firewall policy
edit 32
set name "Allow-in-EMS"
set uuid d90bd78a-fe42-51ee-5614-00952a1efac4
set srcintf "EMS_IKEv1_F_NB"
set dstintf "TRK3"
set action accept
set srcaddr "IKEv1_Range"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all
next
end

best regards

Martin

[dbhavsar]

Good day Martin,

Can you provide the following output:
diagnose sys session filter src <source-address>

diagnose sys session filter dst <destination-address>

diagnose sys session list

[mhaneke]

Hello@dbhavsar ,

thank You for Your reply. I will post the output within the next days. I have to setup my own client for a tunnel lab, because my colleague quit already for the weekend.

best regards

Martin

[funkylicious]

Can you post a sanitized output of the command, show vpn ipsec phase1-interface <> ?