IPsec-VPN is UP but no traffic detected

[posemman]

Hi! needed help,

I set-up ipsec thru fortigate and both site is now up but there was no traffic detected.

unreachable when pinging both remote lan IP.

Below is the logs when i run "diagnose debug application ike -1"

FGT60E4Q16009346 # ike 0:IPSEC - DSL: link is idle 31 10.200.100.100->170.200.80.200:0 dpd=2 seqno=5 ike 0:IPSEC - DSL:55: send IKEv1 DPD probe, seqno 5 ike 0:IPSEC - DSL:55: enc 46B2465D2540FB58B9054A13E7AF47510810050154E662AA000000 600B00002452A96244DEF6E61AD82D50AACB9558A47E96FD061D2F8886938CA098A2CDFCED000000 200000000101108D2846B2465D2540FB58B9054A13E7AF475100000005 ike 0:IPSEC - DSL:55: out 46B2465D2540FB58B9054A13E7AF47510810050154E662AA000000 6C5F6E855BED0F09B86AA6CAEFC3CC0B0BA4C91311C4072BF1771CE00C8ED8A159C81CB589A7F09A 10D368189297F68800280BCAB8FE2B5D347AD83142B8B4D48FE0BD8FABF3162CB6475FCEBDA9D544 F1 ike 0:IPSEC - DSL:55: sent IKE msg (R-U-THERE): 10.200.100.100:500->170.200.80.200:500, len=108, id=46b2465d2540fb58/b9054a13e7af4751:54e662aa ike 0: comes 170.200.80.200:500->10.200.100.100:500,ifindex=31.... ike 0: IKEv1 exchange=Informational id=46b2465d2540fb58/b9054a13e7af4751:5510501 2 len=108 ike 0: in 46B2465D2540FB58B9054A13E7AF475108100501551050120000006CDCF66FF79C73AF 1FB41D08B1AAD4966FE383C0D8C02A128175BC8BE61B0337F7BF284DBC49262E59DE19D14797832E BE033D404D41C50E97EAEEEFD333A9148CE34BCAA8356E44C3A5F3CD083F5DAFDE ike 0:IPSEC - DSL:55: dec 46B2465D2540FB58B9054A13E7AF47510810050155105012000000 6C0B000024813D3ABB80DEC6DEE05F20B5CD57D96148DEFAA07E3E8F040E54FE271CE16B2A000000 200000000101108D2946B2465D2540FB58B9054A13E7AF475100000005BAB24DDAC6FFE0B5ED3CE7 0B ike 0:IPSEC - DSL:55: notify msg received: R-U-THERE-ACK ike shrank heap by 126976 bytes

[Yurisk]

Your debug does not show any traffic trying to use this tunnel, just keep alives between firewalls. Check Phase 2 selectors on Fortigate and make sure you routed remote LAN(s) via IPSec tunnel interface that was auto-created when you created this IPsec VPN. 

Also worth doing sniffer for the traffic to remote LANs to see if it is even reaching the Fortigate.

If new to all of this, you can copy&paste debug/sniffer commands from http://yurisk.info/2009/04/21/debug-vpn-in-fortigate-seeing-is-believing/ 

[emnoc]

He really needs to use "diag debug flow" and debug a flow between local/remote subnets. That will explain what route is look-up, what interface, what policyID if matched.

The "diag debug flow" is your friend.

Ken Felix