IPSec tunnel up (phase 1 and 2) but no Outgoing Data

[pieciaq]

Hi all,

got configured IPSec tunnel it is up (phase 1 and 2) but no Outgoing Data.

Policy from Zone (with vlan10 in it) to VPN tunnel configured, Static Route (with subnet I try to reach, and VPN interface configured) also.

When Ping from computer with vlan10 I see deny and hit policy 0 in FAZ.

What is the best practice to check why traffic is not hitting this tunnel or policy?

P.S I have access only to my side of tunnel.

P.S II. Is is possible that when my part of the tunnel is configured ok, policy and route also but on the other side of the tunnel something is missing tunnel will show up on 2 phases but will send no data to the tunnel?

What's bother me is that there is O B in Outgoing data.

FGT OS. 6.4.6

[pieciaq]

It is like this:

id=20085 trace_id=1 func=fw_local_in_handler line=435 msg="iprope_in_check() check failed on policy 0, drop"

[Debbie_FTNT]

Hey pieciaq,

to clarify - you have a static route configured via VPN tunnel?

-> the gateway you included above, 10.55.10.51, is that the correct gateway reachable through the tunnel?

You also have a policy from a zone (of which your vlan10 interface is a member) to the tunnel?

-> have you checked the policy details for the following:

1. it allows ICMP

2. the source/destination addresses match your traffic

You can use the 'Policy Lookup' tool in the policy table to determine if you have a matching policy in place (to verify that your ping matches into the configured zone->IPSec policy):

Hope this helps :)
Cheers!

[pieciaq]

Thanks a lot for your help, 

yes I check Policy Lookup, when I choose source,(computer IP from I Ping), destination target IP (computer IP behind tunnel), Protocol specify and protocol number 1 (equivalent of ICMP) it show me route with my tunnel interface, so think here is ok.

So if tunnel is up (all phases), show good route, it can be only problem with policy?