IPsec VPN for Remote Access Network Issue

[akazemfar]

I am able to connect to my IKE v2 IPsec tunnel for remote access using my local laptop plugged directly in to internal1 port, however I cannot ping lan (VLAN gateway 172.16.10.1) that sits behind FortiGate.

FortiOS version is 7.4.7 and FortiClient on laptop is 7.4.3.1761

I configured IKE v2 using API POST/PUT and this is what the final phase 1 tunnel looks like:

{
      "name":"IPSEC_VPN",
      "q_origin_key":"IPSEC_VPN",
      "type":"dynamic",
      "interface":"internal",
      "ip-version":"4",
      "ike-version":"2",
      "local-gw":"0.0.0.0",
      "local-gw6":"::",
      "remote-gw":"0.0.0.0",
      "remote-gw6":"::",
      "remotegw-ddns":"",
      "keylife":28800,
      "certificate":[
      ],
      "authmethod":"psk",
      "authmethod-remote":"",
      "mode":"main",
      "peertype":"any",
      "peerid":"",
      "default-gw":"0.0.0.0",
      "default-gw-priority":0,
      "usrgrp":"",
      "peer":"",
      "peergrp":"",
      "monitor":"",
      "monitor-hold-down-type":"immediate",
      "monitor-hold-down-delay":0,
      "monitor-hold-down-weekday":"sunday",
      "monitor-hold-down-time":"00:00",
      "net-device":"disable",
      "passive-mode":"disable",
      "exchange-interface-ip":"disable",
      "exchange-ip-addr4":"0.0.0.0",
      "exchange-ip-addr6":"::",
      "aggregate-member":"disable",
      "aggregate-weight":1,
      "mode-cfg":"enable",
      "assign-ip":"enable",
      "assign-ip-from":"name",
      "ipv4-start-ip":"0.0.0.0",
      "ipv4-end-ip":"0.0.0.0",
      "ipv4-netmask":"255.255.255.255",
      "dhcp-ra-giaddr":"0.0.0.0",
      "dhcp6-ra-linkaddr":"::",
      "dns-mode":"auto",
      "ipv4-dns-server1":"0.0.0.0",
      "ipv4-dns-server2":"0.0.0.0",
      "ipv4-dns-server3":"0.0.0.0",
      "ipv4-wins-server1":"0.0.0.0",
      "ipv4-wins-server2":"0.0.0.0",
      "ipv4-exclude-range":[
      ],
      "ipv4-split-include":"ALL_INTERNAL_SUBNETS",
      "split-include-service":"",
      "ipv4-name":"VPN-ADDRESS-POOL",
      "ipv6-start-ip":"::",
      "ipv6-end-ip":"::",
      "ipv6-prefix":128,
      "ipv6-dns-server1":"::",
      "ipv6-dns-server2":"::",
      "ipv6-dns-server3":"::",
      "ipv6-exclude-range":[
      ],
      "ipv6-split-include":"",
      "ipv6-name":"",
      "ip-delay-interval":0,
      "unity-support":"disable",
      "domain":"",
      "banner":"",
      "include-local-lan":"disable",
      "ipv4-split-exclude":"",
      "ipv6-split-exclude":"",
      "save-password":"disable",
      "client-auto-negotiate":"disable",
      "client-keep-alive":"disable",
      "backup-gateway":[
      ],
      "proposal":"aes256-sha256",
      "add-route":"enable",
      "add-gw-route":"disable",
      "psksecret":"ENC XXXX",
      "psksecret-remote":"",
      "keepalive":10,
      "distance":15,
      "priority":1,
      "localid":"",
      "localid-type":"auto",
      "auto-negotiate":"enable",
      "negotiate-timeout":30,
      "fragmentation":"enable",
      "ip-fragmentation":"post-encapsulation",
      "dpd":"on-idle",
      "dpd-retrycount":3,
      "dpd-retryinterval":"60",
      "forticlient-enforcement":"disable",
      "comments":"",
      "npu-offload":"enable",
      "send-cert-chain":"enable",
      "dhgrp":"21",
      "suite-b":"disable",
      "eap":"enable",
      "eap-identity":"send-request",
      "eap-exclude-peergrp":"",
      "acct-verify":"disable",
      "ppk":"disable",
      "ppk-secret":"",
      "ppk-identity":"",
      "wizard-type":"custom",
      "xauthtype":"auto",
      "reauth":"disable",
      "authusr":"",
      "authpasswd":"",
      "group-authentication":"disable",
      "group-authentication-secret":"",
      "authusrgrp":"VPN-USERS",
      "mesh-selector-type":"disable",
      "idle-timeout":"disable",
      "idle-timeoutinterval":15,
      "ha-sync-esp-seqno":"enable",
      "fgsp-sync":"disable",
      "inbound-dscp-copy":"disable",
      "auto-discovery-sender":"disable",
      "auto-discovery-receiver":"disable",
      "auto-discovery-forwarder":"disable",
      "auto-discovery-psk":"disable",
      "auto-discovery-shortcuts":"independent",
      "encapsulation":"none",
      "encapsulation-address":"ike",
      "encap-local-gw4":"0.0.0.0",
      "encap-local-gw6":"::",
      "encap-remote-gw4":"0.0.0.0",
      "encap-remote-gw6":"::",
      "vni":0,
      "nattraversal":"enable",
      "fragmentation-mtu":1200,
      "childless-ike":"disable",
      "rekey":"enable",
      "digital-signature-auth":"disable",
      "signature-hash-alg":"sha2-512 sha2-384 sha2-256 sha1",
      "rsa-signature-format":"pkcs1",
      "enforce-unique-id":"disable",
      "cert-id-validation":"enable",
      "fec-egress":"disable",
      "fec-send-timeout":5,
      "fec-base":10,
      "fec-codec":"rs",
      "fec-redundant":1,
      "fec-ingress":"disable",
      "fec-receive-timeout":50,
      "fec-health-check":"",
      "fec-mapping-profile":"",
      "network-overlay":"disable",
      "network-id":0,
      "loopback-asymroute":"enable"
    }

Phase 2 looks like:

    {
      "name":"IPSEC_VPN_PHASE2",
      "q_origin_key":"IPSEC_VPN_PHASE2",
      "phase1name":"IPSEC_VPN",
      "dhcp-ipsec":"disable",
      "proposal":"aes256-sha256",
      "pfs":"enable",
      "ipv4-df":"disable",
      "dhgrp":"21",
      "replay":"enable",
      "keepalive":"enable",
      "auto-negotiate":"disable",
      "add-route":"phase1",
      "inbound-dscp-copy":"phase1",
      "auto-discovery-sender":"phase1",
      "auto-discovery-forwarder":"phase1",
      "keylifeseconds":28800,
      "keylifekbs":5120,
      "keylife-type":"seconds",
      "single-source":"disable",
      "route-overlap":"use-new",
      "encapsulation":"tunnel-mode",
      "l2tp":"disable",
      "comments":"",
      "initiator-ts-narrow":"disable",
      "diffserv":"disable",
      "diffservcode":"000000",
      "protocol":6,
      "src-name":"",
      "src-name6":"",
      "src-addr-type":"subnet",
      "src-end-ip6":"::",
      "src-subnet":"0.0.0.0 0.0.0.0",
      "src-port":0,
      "dst-name":"",
      "dst-name6":"",
      "dst-addr-type":"subnet",
      "dst-end-ip6":"::",
      "dst-subnet":"0.0.0.0 0.0.0.0",
      "dst-port":0
    }

Firewall policy:
show firewall policy
config firewall policy
edit 1
set name "IPSEC VPN -> SCADA-ZONE"
set uuid dc5510c6-351b-51f0-e02e-26945f794554
set srcintf "IPSEC_VPN"
set dstintf "SCADA-ZONE"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all
set nat enable
next
edit 2
set name "IPSEC VPN -> DMZ-ZONE"
set uuid dc688e58-351b-51f0-b7dd-f5a8e690d061
set srcintf "IPSEC_VPN"
set dstintf "DMZ-ZONE"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all
set nat enable
next
end

User is username and group is VPN-USER. When attempting to ping 172.16.10.1 from laptop after connection to vpn I get:

FW01 # diagnose debug enable

FW01 # 2025-05-19 19:03:40 id=65308 trace_id=41 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.212.134.60:1821->172.16.10.1:2048) tun_id=10.212.134.60 from IPSEC_VPN. type=8, code=0, id=1821, seq=0."
2025-05-19 19:03:40 id=65308 trace_id=41 func=ipsec_spoofed4 line=245 msg="src ip 10.212.134.60 match selector 0 range 10.212.134.60-10.212.134.60"
2025-05-19 19:03:40 id=65308 trace_id=41 func=init_ip_session_common line=6070 msg="allocate a new session-00000179"
2025-05-19 19:03:40 id=65308 trace_id=41 func=vf_ip_route_input_common line=2612 msg="find a route: flag=80000000 gw-172.16.10.1 via root"
2025-05-19 19:03:40 id=65308 trace_id=41 func=__iprope_tree_check line=539 msg="gnum-100004, use addr/intf hash, len=3"
2025-05-19 19:03:40 id=65308 trace_id=41 func=get_new_addr line=1265 msg="find SNAT: IP-172.16.10.1(from IPPOOL), port-62238"
2025-05-19 19:03:40 id=65308 trace_id=42 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 172.16.10.1:1821->10.212.134.60:0) tun_id=0.0.0.0 from local. type=0, code=0, id=1821, seq=0."
2025-05-19 19:03:40 id=65308 trace_id=42 func=resolve_ip_tuple_fast line=5974 msg="Find an existing session, id-00000179, reply direction"
2025-05-19 19:03:40 id=65308 trace_id=42 func=ip_session_core_in line=6591 msg="dir-1, tun_id=10.212.134.60"
2025-05-19 19:03:40 id=65308 trace_id=42 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface IPSEC_VPN, tun_id=10.212.134.60"
2025-05-19 19:03:40 id=65308 trace_id=42 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel IPSEC_VPN_0, tun_id=10.212.134.60, vrf 0"
2025-05-19 19:03:40 id=65308 trace_id=42 func=ipsec_common_output4 line=917 msg="No matching IPsec selector, drop"
2025-05-19 19:03:41 id=65308 trace_id=43 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.212.134.60:1821->172.16.10.1:2048) tun_id=10.212.134.60 from IPSEC_VPN. type=8, code=0, id=1821, seq=1."
2025-05-19 19:03:41 id=65308 trace_id=43 func=resolve_ip_tuple_fast line=5974 msg="Find an existing session, id-00000179, original direction"
2025-05-19 19:03:41 id=65308 trace_id=43 func=ipsec_spoofed4 line=245 msg="src ip 10.212.134.60 match selector 0 range 10.212.134.60-10.212.134.60"
2025-05-19 19:03:41 id=65308 trace_id=44 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 172.16.10.1:1821->10.212.134.60:0) tun_id=0.0.0.0 from local. type=0, code=0, id=1821, seq=1."
2025-05-19 19:03:41 id=65308 trace_id=44 func=resolve_ip_tuple_fast line=5974 msg="Find an existing session, id-00000179, reply direction"
2025-05-19 19:03:41 id=65308 trace_id=44 func=ip_session_core_in line=6591 msg="dir-1, tun_id=10.212.134.60"
2025-05-19 19:03:41 id=65308 trace_id=44 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface IPSEC_VPN, tun_id=10.212.134.60"
2025-05-19 19:03:41 id=65308 trace_id=44 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel IPSEC_VPN_0, tun_id=10.212.134.60, vrf 0"
2025-05-19 19:03:41 id=65308 trace_id=44 func=ipsec_common_output4 line=917 msg="No matching IPsec selector, drop"
2025-05-19 19:03:42 id=65308 trace_id=45 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 10.212.134.60:1821->172.16.10.1:2048) tun_id=10.212.134.60 from IPSEC_VPN. type=8, code=0, id=1821, seq=2."
2025-05-19 19:03:42 id=65308 trace_id=45 func=resolve_ip_tuple_fast line=5974 msg="Find an existing session, id-00000179, original direction"
2025-05-19 19:03:42 id=65308 trace_id=45 func=ipsec_spoofed4 line=245 msg="src ip 10.212.134.60 match selector 0 range 10.212.134.60-10.212.134.60"
2025-05-19 19:03:42 id=65308 trace_id=46 func=print_pkt_detail line=5879 msg="vd-root:0 received a packet(proto=1, 172.16.10.1:1821->10.212.134.60:0) tun_id=0.0.0.0 from local. type=0, code=0, id=1821, seq=2."
2025-05-19 19:03:42 id=65308 trace_id=46 func=resolve_ip_tuple_fast line=5974 msg="Find an existing session, id-00000179, reply direction"
2025-05-19 19:03:42 id=65308 trace_id=46 func=ip_session_core_in line=6591 msg="dir-1, tun_id=10.212.134.60"
2025-05-19 19:03:42 id=65308 trace_id=46 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface IPSEC_VPN, tun_id=10.212.134.60"
2025-05-19 19:03:42 id=65308 trace_id=46 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel IPSEC_VPN_0, tun_id=10.212.134.60, vrf 0"
2025-05-19 19:03:42 id=65308 trace_id=46 func=ipsec_common_output4 line=917 msg="No matching IPsec selector, drop"

Main issue seems to be "No matching IPsec selector, drop". Performing diagnose vpn tunnel list yields:

#######

diagnose vpn tunnel list
list all ipsec tunnel in vd 0
------------------------------------------------------
name=IPSEC_VPN_0 ver=2 serial=c 192.168.1.99:4500->192.168.1.1:52417 nexthop=192.168.1.1 tun_id=10.212.134.60 tun_id6=::10.0.0.9 status=up dst_mtu=1500 weight=1
bound_if=28 real_if=28 lgwy=static/1 tun=intf mode=dial_inst/3 encap=none/74664 options[123a8]=npu rgwy-chg rport-chg frag-rfc run_state=0 role=sync-primary accept_traffic=1 overlay_id=0

parent=IPSEC_VPN index=0
proxyid_num=1 child_num=0 refcnt=6 ilast=108 olast=114 ad=/0
stat: rxp=53 txp=0 rxb=7914 txb=0
dpd: mode=on-idle on=1 status=ok idle=60000ms retry=3 count=0 seqno=1
natt: mode=keepalive draft=0 interval=10 remote_port=52417
fec: egress=0 ingress=0
proxyid=IPSEC_VPN_PHASE2 proto=6 sa=1 ref=2 serial=1 add-route
src: 6:0.0.0.0-255.255.255.255:0
dst: 6:10.212.134.60-10.212.134.60:0
SA: ref=4 options=6a7 type=00 soft=0 mtu=1422 expire=28674/0B replaywin=2048
seqno=1 esn=0 replaywin_lastseq=0000002f qat=0 rekey=0 hash_search_len=1
life: type=01 bytes=0/0 timeout=28789/28800
dec: spi=dc87b5d1 esp=aes key=32 2a14be313959d7d06c135e525224caf274f0176f0427c72b62b864f3a76a59c6
ah=sha256 key=32 8ad45ff3b582b64d6cafbba06195b43bb111db9f4c762a1cc5006c18c3211720
enc: spi=0b02d32a esp=aes key=32 9738852e3bdba8c93460c9315d5f0fa909d0ed7ce97dddd2a32abbdf0a6066af
ah=sha256 key=32 15f3b5a63345ee19eb39f5665c4f146ca52b0d00066e80468fcde4bbdfe0f6b2
dec:pkts/bytes=6/492, enc:pkts/bytes=0/0
npu_flag=02 npu_rgwy=192.168.1.1 npu_lgwy=192.168.1.99 npu_selid=7 dec_npuid=1 enc_npuid=0 npu_isaidx=9 npu_osaidx=-1
------------------------------------------------------
name=IPSEC_VPN ver=2 serial=8 192.168.1.99:0->0.0.0.0:0 nexthop=192.168.1.1 tun_id=10.0.0.4 tun_id6=::10.0.0.4 status=up dst_mtu=0 weight=1
bound_if=28 real_if=0 lgwy=static/1 tun=intf mode=dialup/2 encap=none/552 options[0228]=npu frag-rfc role=primary accept_traffic=1 overlay_id=0

proxyid_num=0 child_num=1 refcnt=3 ilast=42953733 olast=42953733 ad=/0
stat: rxp=1493 txp=57 rxb=235583 txb=5350
dpd: mode=on-idle on=-1 status=ok idle=60000ms retry=3 count=0 seqno=0
natt: mode=none draft=0 interval=0 remote_port=0
fec: egress=0 ingress=0

[akazemfar]

Doesn't seem to be any routing issue with static route addition.

[funkylicious]

the issue appears to be related to the ipsec configuration, since you can see in the logs 

msg="No matching IPsec selector, drop"

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-VPN-Tunnel-Errors-Due-to-Traff...

you have provided an output for phase1 and phase2 ( acsc ) but they dont seem to be the ones actually being used, since you are using in the firewall rules IPSEC_VPN tunnel name,

also the ip assignment is different from the one configured

config:

"ipv4-start-ip":"10.100.200.10",
"ipv4-end-ip":"10.100.200.20",

vs

assigned:

10.212.134.60

i would start by looking into these.

[akazemfar]

You are correct, it was an error of adding the incorrect phase 1 and phase 2. This has now been updated in original prompt.

[akazemfar]

I am plugging directly into the WAN port and connecting to the IPsec VPN. I am then pinging the subinterface IP that is on a VLAN switch. The firewall rules above are all that is configured as policy. Routing should have no problem after the firewall rule allowing the IPsec interface to get to the SCADA zone (VLAN switch interface is added to this) is configured. My star quarterback is looking more like a perennial backup...

[dingjerry_FTNT]

Hi @akazemfar ,

1) Technically, if the destination LAN network knows how to return the traffic, no need to enable NAT in the firewall policies for the IPSec VPN traffic;

2) Double check whether you have any IP Pool configured with or including 172.16.10.1

[akazemfar]

1) This has been tested with NAT enabled and disabled to no avail. The same error is shown in logs.
2) Only thing with 172.16.10.0/24 is an address object

[dingjerry_FTNT]

2025-05-19 19:03:40 id=65308 trace_id=41 func=vf_ip_route_input_common line=2612 msg="find a route: flag=80000000 gw-172.16.10.1 via root"
2025-05-19 19:03:40 id=65308 trace_id=41 func=__iprope_tree_check line=539 msg="gnum-100004, use addr/intf hash, len=3"
2025-05-19 19:03:40 id=65308 trace_id=41 func=get_new_addr line=1265 msg="find SNAT: IP-172.16.10.1(from IPPOOL), port-62238"

1) "found a route ...  via root" 

This usually means that the destination IP is local on the FGT

2) "from IPPOOL" 

This tells me that it might be related to an IP Pool.

So please either provide your FGT config (if you have a ticket with FTNT already, please provide me the ticket number) or double check whether there is any IP Pool or VIP using this IP  (like I said before,  including 172.16.10.1 also may caus the issue)

[akazemfar]

Added screenshots for clarity.