Ipsec between two sites is not passing traffic all traffic

[boozely25]

I have two sites A and B.

Site A -

Internal Int - 192.168.10.10

Elan Int - 192.168.16.1

Site B

Internal - 192.168.12.10

Elan Int - 192.168.16.2

I have successfully created a tunnel between the two sites. I can ping from Site A internal subnet to Site B internal subnet so I know it can pass traffic.  I have vlans on a core switch connected to Site A Internal Int. I have setup static routes from the vlan subnets connected to A to the internal  Subnet on Site B and vice versa and created rules on both sides allowing the traffic but still cannot ping from vlan to subnet of  site B or from Subnet B to vlan.

Any suggestions?

[emnoc]

the cli cmd diag debug flow wil shed light into the issues. Since you can ping it seems routing between local/remote subnets are good

[sw2090]

Did you - on both sides - set up all required policies and routes?

In doubt: yes "diag debug flow ... " on console will shed light :)

[boozely25]

Site B Fortigate 60E - I did a diag debug flow and then a traceroute to 192.168.203.1(vlan int on core switch).

Here is the output.  Any insight would be greatly appreciated.

DR_ELAN # execute traceroute 192.168.203.1 id=20085 trace_id=6 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=1, 192.168.11.10:51571->192.168.203.1:2048) from local. type=8, code=0, id=51571, seq=1." id=20085 trace_id=6 func=init_ip_session_common line=5493 msg="allocate a new session-00004048" id=20085 trace_id=6 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-DR-to-HQ" id=20085 trace_id=6 func=esp_output4 line=897 msg="IPsec encrypt/auth" id=20085 trace_id=6 func=ipsec_output_finish line=532 msg="send to 192.168.21.1 via intf-ELAN" traceroute to 192.168.203.1 (192.168.203.1), 32 hops max, 3 probe packets per hop, 72 byte packets  1  *id=20085 trace_id=7 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=1, 192.168.11.10:51571->192.168.203.1:2048) from local. type=8, code=0, id=51571, seq=2." id=20085 trace_id=7 func=resolve_ip_tuple_fast line=5408 msg="Find an existing session, id-00004048, original direction" id=20085 trace_id=7 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-DR-to-HQ" id=20085 trace_id=7 func=esp_output4 line=897 msg="IPsec encrypt/auth" id=20085 trace_id=7 func=ipsec_output_finish line=532 msg="send to 192.168.21.1 via intf-ELAN"  *id=20085 trace_id=8 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=1, 192.168.11.10:51571->192.168.203.1:2048) from local. type=8, code=0, id=51571, seq=3." id=20085 trace_id=8 func=resolve_ip_tuple_fast line=5408 msg="Find an existing session, id-00004048, original direction" id=20085 trace_id=8 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-DR-to-HQ" id=20085 trace_id=8 func=esp_output4 line=897 msg="IPsec encrypt/auth" id=20085 trace_id=8 func=ipsec_output_finish line=532 msg="send to 192.168.21.1 via intf-ELAN"  *id=20085 trace_id=9 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=1, 192.168.11.10:51571->192.168.203.1:2048) from local. type=8, code=0, id=51571, seq=4." id=20085 trace_id=9 func=resolve_ip_tuple_fast line=5408 msg="Find an existing session, id-00004048, original direction" id=20085 trace_id=9 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-DR-to-HQ" id=20085 trace_id=9 func=esp_output4 line=897 msg="IPsec encrypt/auth" id=20085 trace_id=9 func=ipsec_output_finish line=532 msg="send to 192.168.21.1 via intf-ELAN"    2  *id=20085 trace_id=10 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=1, 192.168.11.10:51571->192.168.203.1:2048) from local. type=8, code=0, id=51571, seq=5." id=20085 trace_id=10 func=resolve_ip_tuple_fast line=5408 msg="Find an existing session, id-00004048, original direction" id=20085 trace_id=10 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-DR-to-HQ" id=20085 trace_id=10 func=esp_output4 line=897 msg="IPsec encrypt/auth" id=20085 trace_id=10 func=ipsec_output_finish line=532 msg="send to 192.168.21.1 via intf-ELAN"  *id=20085 trace_id=11 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=1, 192.168.11.10:51571->192.168.203.1:2048) from local. type=8, code=0, id=51571, seq=6." id=20085 trace_id=11 func=resolve_ip_tuple_fast line=5408 msg="Find an existing session, id-00004048, original direction" id=20085 trace_id=11 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-DR-to-HQ" id=20085 trace_id=11 func=esp_output4 line=897 msg="IPsec encrypt/auth" id=20085 trace_id=11 func=ipsec_output_finish line=532 msg="send to 192.168.21.1 via intf-ELAN"  *id=20085 trace_id=12 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=1, 192.168.11.10:51571->192.168.203.1:2048) from local. type=8, code=0, id=51571, seq=7." id=20085 trace_id=12 func=resolve_ip_tuple_fast line=5408 msg="Find an existing session, id-00004048, original direction" id=20085 trace_id=12 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-DR-to-HQ" id=20085 trace_id=12 func=esp_output4 line=897 msg="IPsec encrypt/auth" id=20085 trace_id=12 func=ipsec_output_finish line=532 msg="send to 192.168.21.1 via intf-ELAN"    3  *id=20085 trace_id=13 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=1, 192.168.11.10:51571->192.168.203.1:2048) from local. type=8, code=0, id=51571, seq=8." id=20085 trace_id=13 func=resolve_ip_tuple_fast line=5408 msg="Find an existing session, id-00004048, original direction" id=20085 trace_id=13 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-DR-to-HQ" id=20085 trace_id=13 func=esp_output4 line=897 msg="IPsec encrypt/auth" id=20085 trace_id=13 func=ipsec_output_finish line=532 msg="send to 192.168.21.1 via intf-ELAN"  *id=20085 trace_id=14 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=1, 192.168.11.10:51571->192.168.203.1:2048) from local. type=8, code=0, id=51571, seq=9." id=20085 trace_id=14 func=resolve_ip_tuple_fast line=5408 msg="Find an existing session, id-00004048, original direction" id=20085 trace_id=14 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-DR-to-HQ" id=20085 trace_id=14 func=esp_output4 line=897 msg="IPsec encrypt/auth" id=20085 trace_id=14 func=ipsec_output_finish line=532 msg="send to 192.168.21.1 via intf-ELAN"  *id=20085 trace_id=15 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=1, 192.168.11.10:51571->192.168.203.1:2048) from local. type=8, code=0, id=51571, seq=10." id=20085 trace_id=15 func=resolve_ip_tuple_fast line=5408 msg="Find an existing session, id-00004048, original direction" id=20085 trace_id=15 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-DR-to-HQ" id=20085 trace_id=15 func=esp_output4 line=897 msg="IPsec encrypt/auth" id=20085 trace_id=15 func=ipsec_output_finish line=532 msg="send to 192.168.21.1 via intf-ELAN"    4  *id=20085 trace_id=16 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=1, 192.168.11.10:51571->192.168.203.1:2048) from local. type=8, code=0, id=51571, seq=11." id=20085 trace_id=16 func=resolve_ip_tuple_fast line=5408 msg="Find an existing session, id-00004048, original direction" id=20085 trace_id=16 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-DR-to-HQ" id=20085 trace_id=16 func=esp_output4 line=897 msg="IPsec encrypt/auth" id=20085 trace_id=16 func=ipsec_output_finish line=532 msg="send to 192.168.21.1 via intf-ELAN"  *id=20085 trace_id=17 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=1, 192.168.11.10:51571->192.168.203.1:2048) from local. type=8, code=0, id=51571, seq=12." id=20085 trace_id=17 func=resolve_ip_tuple_fast line=5408 msg="Find an existing session, id-00004048, original direction" id=20085 trace_id=17 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-DR-to-HQ" id=20085 trace_id=17 func=esp_output4 line=897 msg="IPsec encrypt/auth" id=20085 trace_id=17 func=ipsec_output_finish line=532 msg="send to 192.168.21.1 via intf-ELAN"  *id=20085 trace_id=18 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=1, 192.168.11.10:51571->192.168.203.1:2048) from local. type=8, code=0, id=51571, seq=13." id=20085 trace_id=18 func=resolve_ip_tuple_fast line=5408 msg="Find an existing session, id-00004048, original direction" id=20085 trace_id=18 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-DR-to-HQ" id=20085 trace_id=18 func=esp_output4 line=897 msg="IPsec encrypt/auth" id=20085 trace_id=18 func=ipsec_output_finish line=532 msg="send to 192.168.21.1 via intf-ELAN"    5  *id=20085 trace_id=19 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=1, 192.168.11.10:51571->192.168.203.1:2048) from local. type=8, code=0, id=51571, seq=14." id=20085 trace_id=19 func=resolve_ip_tuple_fast line=5408 msg="Find an existing session, id-00004048, original direction" id=20085 trace_id=19 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-DR-to-HQ" id=20085 trace_id=19 func=esp_output4 line=897 msg="IPsec encrypt/auth" id=20085 trace_id=19 func=ipsec_output_finish line=532 msg="send to 192.168.21.1 via intf-ELAN"  *id=20085 trace_id=20 func=print_pkt_detail line=5333 msg="vd-root:0 received a packet(proto=1, 192.168.11.10:51571->192.168.203.1:2048) from local. type=8, code=0, id=51571, seq=15." id=20085 trace_id=20 func=resolve_ip_tuple_fast line=5408 msg="Find an existing session, id-00004048, original direction" id=20085 trace_id=20 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-DR-to-HQ" id=20085 trace_id=20 func=esp_output4 line=897 msg="IPsec encrypt/auth" id=20085 trace_id=20 func=ipsec_output_finish line=532 msg="send to 192.168.21.1 via intf-ELAN"  *  6  * * *  7  * * *  8  * * *  9  * * * 10  * * * 11  * * * 12  * * * 13  * * * 14  * * * 15  * * * 16  * * * 17  * * * 18  * * *

[GentX]

Hi Boozely25

You have to look at first if your routing configuration works and if your firewall policy works inside your Fortigate as the previous comment said you before.

If I can add a tip.

If you want to test step by step and find where is the problem:

Try this command on your Fortigate:

FGT# diagnose sniffer packet any "icmp" 4

Then try to ping every interface which has an IP address and try to target where is the problem exactly because with your previous post, it is hard to find where is the problem, in case for me.

Please provide the result of this command: 

FGT# get router info routing-table database

It is going to show you if there is a route that can route your traffic between the VLAN subnets connected to A to the internal  Subnet on Site B.

Check your gateway of your end terminal. 

If everything is Ok, use the command with filter:

FGT# diag debug flow 

To find if you have a firewall policy which can be a problem and block your traffic.

I hope my help has been useful.