IPsec Tunnels spinning and spinning

[kenny]

I am building VPNs to Rackspace CO-LOs from all of our Fortigates, we have 100e's and 30e's depending on facility size. 

I created our end of the tunnel this evening on a Fortigate 30e. I did what I usually do, Run the wizard for the setup and then choose convert to custom to change the phase 1 and 2 settings as needed. When I finished the wizard and clicked on the IPSec Tunnels menu under VPN, I get the green spinning thing. It just spins for eternity. I did 'get vpn ipsec tunnel summary" and I can see my Tunnel there. a.) anyone have any idea why the thinking wheel just keeps spinning? more importantly, is there a doc somewhere that I can read how to use CLI to change the local subnet in phase 2. Its listed as 192.168.2.0/24 and it needs to be 192.168.4.0/22. 

I want to learn the commands to see the contents of each phase and the syntax to make the change I need to make.

Any Document that could teach me CLI syntax would be awesome. 

As would any specific help with aforementioned issues

this is the result of "diagnose vpn tunnel list" ------------------------------------------------------ name=rackspace ver=1 serial=1 104.137.186.200:0->161.47.114.90:0 bound_if=4 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/0 proxyid_num=1 child_num=0 refcnt=11 ilast=5 olast=5 ad=/0 stat: rxp=0 txp=0 rxb=0 txb=0 dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0 natt: mode=none draft=0 interval=0 remote_port=0 proxyid=rackspace proto=0 sa=0 ref=1 serial=1 src: 0:192.168.1.0/255.255.255.0:0 [style="background-color: #ffff00;"]dst: 0:192.168.2.0/255.255.255.0:0 [style="background-color: #ffffff;"] This is the line I need to change... if I could just change this to 192.168.4.0/22... I think the tunnel would at least be up.[/style][/style]

[ShawnZA]

You need to do a diag debug flow for that

https://www.fortinetguru.com/2017/01/how-to-debug-the-packet-flow/

https://kb.fortinet.com/kb/documentLink.do?externalID=FD33882

[kenny]

Thank you