IPsec Tunnel Ping Issue Between Firewalls (Source Interface Required)

[sudipkamila]

I have two FortiGate firewalls located at different sites, connected through ISP links as WAN. An IPsec tunnel is established between both firewalls. LAN subnets on both sides can reach each other and ping successfully.

However, when I try to ping the remote LAN subnet from the firewall itself, the ping fails. The ping only works when I manually set the source interface on the firewall. I want to understand why the firewall cannot ping the remote LAN subnet without specifying the source interface.

• Please assist in identifying the cause and provide the required configuration guidance.

[owen911]

FortiGate uses a different interface as a source based on the lowest index number.
Based on local-out traffic, tentatively will be WAN interface.
it a normal behavior 
refer link : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Self-originating-traffic-over-IPSec-VPN-Fo...

[Toshi_Esumi]

Most likely the source IP of the ping packets is outside of phase2 network selector(s). Use "exe ping-option source [the_LAN_interface_IP_inside_of_the_network_selector]". Then ping packets pick that IP for the source IP.

If you're curious what source IP it's picking up now, you can have two SSH sessions into your FGT. Then run like "diag sniffer packet [IPSEC_interface_name] 'icmp'" in one session, then run "exe ping" from another session. You can see the source IP in the sniffer.
Then you can see how it changes after the ping-option.
Toshi

Toshi