Hi all,
I'm new in this forum and also with Fortigate. I know very well screenOs.
I have to migrate some ScreenOs FW to Fortigate, and I've some problem with VPN.
At a moment I try to test a VPN Interface mode between two Fortigate. In my case I need to terminate a VPN to a secondary IP of FGT-B.
The tunnel goes UP, but when I tried to ping a PC on the other side on FGT-A the packet go throught the VPN, on FGT-B I get this error :
id=20085 trace_id=106 func=init_ip_session_common line=4522 msg="allocate a new session-00026962" id=20085 trace_id=106 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-2.0.2.70 via port3" id=20085 trace_id=106 func=fw_forward_handler line=545 msg="Denied by forward policy check (policy 0)"
The policy is present but I don't understand why this traffic don't match the policy.
The configuration of FGT-A is :
edit "wan1" set vdom "root" set ip 192.168.10.1 255.255.255.0 set allowaccess ping fgfm auto-ipsec set type physical set snmp-index 2 next edit "internal1" set vdom "root" set ip 3.3.3.1 255.255.255.0 set allowaccess ping set type physical set snmp-index 8 next config router static edit 1 set dst 2.0.0.0 255.255.252.0 set device "vpn-interface" next edit 2 set dst 217.172.3.177 255.255.255.255 set gateway 192.168.10.46 set device "wan1" next end config vpn ipsec phase1-interface edit "vpn-interface" set interface "wan1" set remote-gw 217.172.3.177 set psksecret ENC IHRvb4gMgBk42WoYDg706BfnZbsRgAhjGJ9Er5NTmxFixdVkPpJMWSDm+X5vssgIL8JwK4gV4vfuoJBC6DJcU3/kZcvQiXCaT6/OarhSVm+oZAEL8EwQ/HxutZQusuL+4Iu+IPtJ7xhnGWfjNOVkrkyALGCmdcBMFBXmIdeRI/Lwz7Tr1YMR7Loilg/LCIopySRvvg== next end
config vpn ipsec phase2-interface edit "vpn-interface" set phase1name "vpn-interface" set keepalive enable set auto-negotiate enable set src-subnet 3.3.3.0 255.255.255.0 set dst-subnet 2.0.0.0 255.255.252.0 next end config firewall policy edit 1 set uuid 9a3cebc8-a6d3-51e4-98c7-8833bac36c83 set srcintf "internal1" set dstintf "vpn-interface" set srcaddr "Local-3.3.3.0/24" set dstaddr "Remote-2.0.0.0/22" set action accept set schedule "always" set service "ALL" set logtraffic all next edit 2 set uuid acf13a62-a6d3-51e4-0f03-cdac80dfdb8c set srcintf "vpn-interface" set dstintf "internal1" set srcaddr "Remote-2.0.0.0/22" set dstaddr "Local-3.3.3.0/24" set action accept set schedule "always" set service "ALL" set logtraffic all next end
Configuration of FGT-B :
config system interface edit "wan1" set vdom "root" set ip 192.168.10.46 255.255.255.0 set allowaccess ping fgfm auto-ipsec set vlanforward enable set type physical set snmp-index 2 set secondary-IP enable config secondaryip edit 1 set ip 217.172.3.177 255.255.255.255 set allowaccess ping next end next end config system interface edit "port3" set vdom "root" set ip 2.0.3.233 255.255.252.0 set allowaccess ping https ssh http telnet set vlanforward enable set type physical set snmp-index 22 next end config router static edit 1 set dst 3.3.3.0 255.255.255.0 set device "Interface-vpn" next end config vpn ipsec phase1-interface edit "Interface-vpn" set interface "wan1" set local-gw 217.172.3.177 set localid "217.172.3.177" set remote-gw 192.168.10.1 set psksecret ENC LCVkCt2hFmGE11lOy3K6u16DYU2pzT2U9bDMy2N+sobbdkUoeHbXKFv5DIUnh5a4qh7ihYVs2R6zwmtGDwf7Co8ZqdiU0H+VXtfajpHlElEFCow9Q1RwFzg4hUphn5KMkEDwn87vWYbIlX4BMBKmiwKgpL8qt+egqnJ3F+tx7ag5QlmW+5xlgKxBb3JH8R21VEaB2w== next end config vpn ipsec phase2-interface edit "Interface-vpn" set phase1name "Interface-vpn" set keepalive enable set auto-negotiate enable set src-subnet 2.0.0.0 255.255.252.0 set dst-subnet 3.3.3.0 255.255.255.0 next end config firewall policy edit 2 set uuid 5496f3f6-a6d4-51e4-e9ba-c7a18745d9ce set srcintf "Interface-vpn" set dstintf "port3" set srcaddr "Remote-3.3.3.0/24" set dstaddr "Local-2.0.0.0/22" set action accept set schedule "always" set service "ALL" set logtraffic all next edit 1 set uuid 42daa2c0-a6d4-51e4-51f1-a9cda2b71e72 set srcintf "port3" set dstintf "Interface-vpn" set srcaddr "Local-2.0.0.0/22" set dstaddr "Remote-3.3.3.0/24" set action accept set schedule "always" set service "ALL" set logtraffic all next end
Someone can help me to understand where is the problem ?
Thanks in advance
Gionata
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi!
I'm not sure if this could be your issue as well, but I recently upgraded the firmware of my 60D from 5.0 Patch7 Build # 3608 to 5.0.10 and then to the latest release 5.2.2 and, in that upgrade the custom service "ALL" erroneously changed its protocol number from "0" to "6" (i.e. from "ANY IP protocol" to just TCP). That change made the message:
msg="Denied by forward policy check (policy 0)"
To pop up in those policies using that custom service. Have you made a firmware upgrade on any one of your FWs? You could check if this is also happening to you executing:
show firewall service custom ALL
Through your FWs console.
Without digging too deeply into the configs, did you make sure that the static routes to the VPN remote endpoints had a shorter distance than the default? It doesn't appear so from what I read.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
Hi!
I'm not sure if this could be your issue as well, but I recently upgraded the firmware of my 60D from 5.0 Patch7 Build # 3608 to 5.0.10 and then to the latest release 5.2.2 and, in that upgrade the custom service "ALL" erroneously changed its protocol number from "0" to "6" (i.e. from "ANY IP protocol" to just TCP). That change made the message:
msg="Denied by forward policy check (policy 0)"
To pop up in those policies using that custom service. Have you made a firmware upgrade on any one of your FWs? You could check if this is also happening to you executing:
show firewall service custom ALL
Through your FWs console.
jdambra wrote:I just want to thank you for helping me solve this problem on one of my firewalls. I upgraded from 5.0.11 to 5.2.2 and found that the service ALL had been changed to protocol 6 instead of 0.Hi!
I'm not sure if this could be your issue as well, but I recently upgraded the firmware of my 60D from 5.0 Patch7 Build # 3608 to 5.0.10 and then to the latest release 5.2.2 and, in that upgrade the custom service "ALL" erroneously changed its protocol number from "0" to "6" (i.e. from "ANY IP protocol" to just TCP). That change made the message:
msg="Denied by forward policy check (policy 0)"
To pop up in those policies using that custom service. Have you made a firmware upgrade on any one of your FWs? You could check if this is also happening to you executing:
show firewall service custom ALL
Through your FWs console.
Damn you Fortinet.
Yeah, I kind of lost like 4 hours of my life with this... I hope this post had helped you to loose a little less than that.
There is never a boring day working in IT...
jdambra wrote:Hi!
I'm not sure if this could be your issue as well, but I recently upgraded the firmware of my 60D from 5.0 Patch7 Build # 3608 to 5.0.10 and then to the latest release 5.2.2 and, in that upgrade the custom service "ALL" erroneously changed its protocol number from "0" to "6" (i.e. from "ANY IP protocol" to just TCP). That change made the message:
msg="Denied by forward policy check (policy 0)"
To pop up in those policies using that custom service. Have you made a firmware upgrade on any one of your FWs? You could check if this is also happening to you executing:
show firewall service custom ALL
Through your FWs console.
I registered to say thank you for this. I spun my wheels for 3 hours trying to figure out why ICMP and UDP were failing on a new install, but TCP worked fine, before I found this post. Pretty major bug to let slip through the cracks...
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.