Remote Access IPsec VPN unable to PING

[Skynet]

I have created an IPsec Remote Access VPN tunnel. When I connect to the tunnel I am unable to ping any interfaces or devices on the LAN. I have firewall policies to allow all traffic to and from the VPN-to-LAN traffic. I am wondering if the issue has to do with my Phase 2 selectors being 0.0.0.0/0 for the local and remote addresses. I do have a static route of 0.0.0.0/0 to the WAN interface, and if it matters there is a site-to-site VPN tunnel set up as well that I would like to be able to ping across to the other site's LAN. Thank you all for your assistance in advance. 

[raffaeledp]

Hello,

just a simple question. What's the network configured in the accessible networks inside the IPSec tunnel? Is the LAN you want to ping inside the "accessible networks". Otherwise all the traffic will be dropped.

[Skynet]

The LAN is in the Accessible Networks, though it is the only thing listed; I am going to work on adding more networks here.

[dingjerry_FTNT]

Hi @Skynet ,

Running debug flow commands will show you why Ping is not working. Since you did not tell us what your FGT firmware version is, I provide the article based on the latest version:

https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/54688/debugging-the-packet-f...

My guess, based on what you said that there are correct firewall policies:

1) You don't have a static route created with your IPSec VPN tunnel.

2) You don't have ICMP/Ping enabled for the Administrative settings on the LAN interface.

[Skynet]

I do have Ping enabled, however I do not have a Static Route configured for the Tunnel With me using 0.0.0.0/0 for the local address for Phase 2, I was unsure for what to put for the route for the VPN tunnel. Should I change the local address to the IP address that is showing up for the tunnel when you look at the interface?

[dingjerry_FTNT]

Hi @Skynet ,

The one you configured in Phase 2 is referred to as the Selector, a terminology used in IPSec VPN phase 2.

This is for bringing up IPSec VPN, not for adding a static route in the routing table. 

Instead, we do have some settings in the IPSec VPN phase 1 settings to add static routes. 

So if you do not have a route entry for the remote peer, i.e., 10.0.0.0/24, with the IPSec VPN, once the traffic is out of the IPSec VPN tunnel, it will be dropped due to "Reverse Path Check failed".

You still need to create a route entry for the remote IPSec VPN peer to avoid the "Reverse Path Check failed" issue.

You may check this article for more info:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Routing-issue-reverse-path-check-fai...

[dingjerry_FTNT]

Another doc:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Reverse-Path-Forwarding-RPF-implementation...