IPSec to IPSec Tunnel Traffic

[graham_morrison]

Hi there everyone,

With everyone going remote working we have come across an issue.  We have our tech support tunnel that us IT support folk are using.  We have another ipsec tunnel that our users are coming in over.  We cannot get traffic to flow between these tunnels.  So far in setting this up I have:

Added the subnets to both tunnels and checked they appear on the client routing tables

Created policy rules with sources and destinations as being the tunnel interfaces

Had sniffers running at the command line and see the traffic going one way over the tunnel and hitting a client pc but nothing coming back.

Running wireshark on clients on either side if the tunnel i can see the ping packets hitting them but them not sending anything back.

Am i missing something super obvious? 

[sw2090]

recheck client routing table. Do you have overlapping subnets there?

recheck client firewall if that is blocking you?

[graham_morrison]

Thanks for reply.  The tracert from the ipsec clients shows the forst hop as the external ip of the FW so that would suggest to me the route is ok since its trying to route it over the tunnel.  All the clients have their local FW's off as well.

[Yurisk]

Strange to hear that from PC ping enters the tunnel, but on the FGT sniffer you see nothing, it is highly unikely for ping to enter the tunnel directed to the FGT and never make to the FGT itself. I'd even say it is impossible. 

Have you run "diag deb flow" on those PC's pings ? Make sure no NAT is involved not to miss packets in sniffer.

[graham_morrison]

Hi there,

I'm sorry i cant have been clear.  I do see the ping on the FGT sniffer when i test this.  I see the echo request but no reply.  It look like traffic can go one way but not the other for each tunnel.

[fortihaza]

hey man did you manage to achive that cause i am in quite similar problem, i want to route my ipsec remote access vpn to site to site vpn. 

[fortihaza]

hey man did you manage to achive that cause i am in quite similar problem, i want to route my ipsec remote access vpn to site to site vpn 

[ekrishnan]

Hi,

Are you referring to Remote access VPN meaning you are connected to FCT for first layer of vpn connection and from there you want it to go through another Site-Site IPSEC tunnel?

If that is the case you will need to add matching selectors on the  existing site-site ipsec tunnel i.e the selectors should include the remote access vpn ip address range in it and also the firewall policies to include this as well.