Issue with Cross-VLAN Communication over VXLAN/IPSEC between Two Sites

[5q46n2te8jPWJY]

Hello,

I am encountering an issue with my configuration that I am unable to resolve.

I have two sites connected with VXLAN over IPSEC. On each of my sites, I have two VLANs (VLAN 10 and VLAN 20).

Here are my tests:

• SITE A / VLAN 10 successfully pings SITE B / VLAN 10
• SITE A / VLAN 20 successfully pings SITE B / VLAN 20
• SITE A / VLAN 10 successfully pings SITE A / VLAN 20
• SITE A / VLAN 20 successfully pings SITE A / VLAN 10
• SITE B / VLAN 10 successfully pings SITE A / VLAN 10
• SITE B / VLAN 20 successfully pings SITE A / VLAN 20
• SITE B / VLAN 10 successfully pings SITE B / VLAN 20
• SITE B / VLAN 20 successfully pings SITE B / VLAN 10

However,

• SITE A / VLAN 10 cannot ping SITE B / VLAN 20
• SITE A / VLAN 20 cannot ping SITE B / VLAN 10
• SITE B / VLAN 10 cannot ping SITE A / VLAN 20
• SITE B / VLAN 20 cannot ping SITE A / VLAN 10

Do you have any idea why?

Thanks for your help!

[HarshChavda]

Hello @5q46n2te8jPWJY ,

Are you using 0.0.0.0/0 in phase2 selector of IPSEC tunnel, if not can you verify if these VLANs are included. We can also check with running a sniffer on both side.

Reference: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Routing-Issue/ta-p/195727