PING on VPN IPSec Azure works only two time

[lorenzhope]

Hi all,

I have a problem on a location connected in VPN IpSec.

I have configured all the interfaces and policy and everything seems working good. 

From the server AD I can ping all the clients connected on the location, the problem is from client to server AD where only two ping are replied, then all requested are dropped. 

Here you can find the diag sniffer on Firewall of that location:

FG100E4Q17011401 # diag sniffer packet arena "host 10.1.11.42 and icmp"

interfaces=[arena]

filters=[host 10.1.11.42 and icmp]

6.091341 10.1.11.42 -> 10.0.0.12: icmp: 10.1.11.42 udp port 54317 unreachable

27.833930 10.1.11.42 -> 10.0.0.12: icmp: 10.1.11.42 udp port 64483 unreachable

35.928811 10.1.11.42 -> 10.0.0.12: icmp: echo request

35.971478 10.0.0.12 -> 10.1.11.42: icmp: echo reply

36.930628 10.1.11.42 -> 10.0.0.12: icmp: echo request

36.972687 10.0.0.12 -> 10.1.11.42: icmp: echo reply

48.690416 10.1.11.42 -> 10.0.0.12: icmp: 10.1.11.42 udp port 64556 unreachable

69.547030 10.1.11.42 -> 10.0.0.12: icmp: 10.1.11.42 udp port 55918 unreachable

91.325987 10.1.11.42 -> 10.0.0.12: icmp: 10.1.11.42 udp port 60528 unreachable

113.099349 10.1.11.42 -> 10.0.0.12: icmp: 10.1.11.42 udp port 49737 unreachable

^C

11 packets received by filter

0 packets dropped by kernel

As you can look on it, two ping obtain reply, the other sent unreachable. The client IP is 10.1.11.42, the Server IP is 10.0.0.12. Which one has the 64556 port blocked? I suppose that is the 10.1.11.42 but in that client the firewall is off and I cannot understand if the Firewall is blocking something or not.

Could you advice me what I can do in order to find a solution? 

Thank you in advance

Lorenzo

[FortiKoala]

You can check the following to see if there some devices causing issues, it might be port exhaustion http://kb.fortinet.com/kb...ternalId=FD33056 

[ul]

In the WebUI, you can use the Dashboard to view the Top source, Top Destination and Top Applications to monitor traffic, see if there are any devices using an unusual amount of bandwith

Check session logs for "Invalid Packets" log section, identify the device

Follow this guide to check which policies are being use by 10.1.11.42 http://kb.fortinet.com/kb...ternalId=FD30038 [/ul]

[lorenzhope]

Hi and thank you for your answer.

I run a diag sys session stat but I not understand how to resolve with this.

Here you can find the results:

FG100E4Q17011401 # diag sys session stat

misc info: session_count=2210 setup_rate=19 exp_count=50 clash=10

 memory_tension_drop=0 ephemeral=0/196608 removeable=0

 npu_session_count=637

 nturbo_session_count=0

delete=0, flush=0, dev_down=0/0 ses_flush_filters=0

TCP sessions:

 50 in NONE state

 492 in ESTABLISHED state

 2 in SYN_SENT state

 1 in SYN_RECV state

 3 in FIN_WAIT state

 29 in TIME_WAIT state

 7 in CLOSE state

 82 in CLOSE_WAIT state

firewall error stat:

error1=00000000

error2=00000000

error3=00000000

error4=00000000

tt=00000000

cont=00a557e5

ids_recv=0858cca9

url_recv=00000000

av_recv=90954a71

fqdn_count=00000006

global: ses_limit=0 ses6_limit=0 rt_limit=0 rt6_limit=0

I found the possible error blocking me: is a Deny DNS error. Strange (because the first two ping are allowed). Could you be helpfull?

ActionDeny: DNS errorPolicy3Policy UUID39e02e9a-d838-51e7-47d0-4c2f5ecb4c2dPolicy Typepolicy