Problems with routing with ipsec tunnel mode

[knut]

I am trying to get a new ipsec tunnel running towards another vendor firewall. I get the tunnel up and running, and I can ping the other side from the CLI in fortigate. But I can't get it from the internal interfaces I got behind the fortigate. I have made the correct firewall rules.

It seems like it doesn't make a default route for the VPN tunnel, so the traffic doesn't go where I would like it to go. I can't figure out if I need to make a static route and to what interface? Since it is not a vpn in interface mode it is a bit difficult to figure out. I will try to make it possible to run in a interface mode, but i'm not sure what the other firewall supports.

I do have another tunnel mode running to another fortigate without any problems with the routing.

[rwpatterson]

Consensus as of late (past few years) is to abandon the tunnel (policy) mode IPSec VPN and use the interface mode because of the problem you are describing exactly. With interface mode, you can point traffic somewhere. With policy mode, you are restricted only to what the other end has defined in the quick mode selectors.

[ede_pfau]

You don't have to worry that the other firewall can't cope with the FGT's tunnel if defined in Interface mode - Interface vs. Policy mode is purely 'Fortinet internal'. It's just an implementation issue and will not be discernable from outside.

So I would wholly support Bob's advice to re-create the VPN in Interface mode (you cannot change the type after creation), create a static route and you're done.

[emnoc]

rt-based vrs policy-based like mention is not revalent. What the OP needs to do is proper diagnostics to figure out what the root  proper are and not guessing. I too would reccommend a rt-based vpn ( aka interfaces ) due to the advantage that these provide

packet sniffer over the interface directly

better route manament

easier to dianose imho

and BCPs as defined by fortinet directly

back to  the problems, yours coud be any of the following;

improper proxy-id defined ( local or remote )

improper fwpolicies ( local or remote )

improper nat-controls (local or remote )

[knut]

Got it running in interface mode now. It seems like there was some errors in the config on the remote site that tunnel mode didn't catch.

I can't ping the remote subnet from the fortigate, do I need some sort of default firewall policy to get that running? I got it running from the internal network that it should have access to, so I got access to the things I need, but it would be nice to be able to look at it from the firewall as well.

Thanks for the help!

[ede_pfau]

Probably the source IP with which the FGT is pinging is not included in the QM selectors resp. in the internal LAN address space. You don't need any additional policy.

You can change the source IP for FGT-originated traffic with

exec ping-options source 192.168.x.y

exec ping <target>

[emnoc]

ditto

And if it's a rt-based vpn ( aka interface vpn ), you could use the diag sniffer packet <phase1-interface name> "icmp" and validate if the pings are sourced by what address.