[SOLVED] VPN site to site and ping

[waaalex]

Hello all,

I've got a VPN site to site.

I had policies to join another network, VPN is up, everything seems to be ok and i can RDP a remote PC.

But ping doeens't work.

In debug, i see that only on "start" router, nothing on remote router. tracert show me that ping does not pass through ipsec...

log tracert

id=20085 trace_id=91 func=print_pkt_detail line=4368 msg="vd-root received a packet(proto=17, 10.0.5.71:137->200.200.4.12:137) from port1. "
id=20085 trace_id=91 func=init_ip_session_common line=4517 msg="allocate a new session-005e8fd0"
id=20085 trace_id=91 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-XX.XX.XX.XX via wan1"
id=20085 trace_id=91 func=fw_forward_handler line=554 msg="Denied by forward policy check (policy 0)"

log ping

id=20085 trace_id=122 func=print_pkt_detail line=4368 msg="vd-root received a packet(proto=1, 10.0.5.151:1->200.200.4.12:8) from port1. code=8, type=0, id=1, seq=539."
id=20085 trace_id=122 func=resolve_ip_tuple_fast line=4427 msg="Find an existing session, id-005eef10, original direction"
id=20085 trace_id=122 func=ipv4_fast_cb line=50 msg="enter fast path"
id=20085 trace_id=122 func=ip_session_run_all_tuple line=5489 msg="SNAT 10.0.5.151->XX.XX.XX.XX:62464"

I'm missing something but what?

Thank you.

[Paul_S]

do you have a route setup in your source fortigate?

[waaalex]

Paul S wrote:

do you have a route setup in your source fortigate?

yes, i've route setup.

The wan2 is not used anymore.

0.0.0.0 0.0.0.0  DEFAULT GATEWAY   wan1   Passerelle par défaut PRI...
10.0.0.0 255.255.255.0   10.0.X.X  port1

10.0.8.0 255.255.255.010.0.X.X   port1

10.0.14.0 255.255.254.0  10.0.X.X  port1

10.0.98.0 255.255.255.0 ssl.root

0.0.0.0 0.0.0.0 10.0.X.Xwan2 Passerelle par défaut SEC...
10.0.7.0 255.255.255.0 10.0.X.X

port1 10.97.97.48 255.255.255.248 VPN_XXX

[Sylvia]

tracert is denied because there is no matching policy for it (you are using udp-tracert).

ping: here I assume that you are using the wrong policy.

Do you configured an interface-or policy-based VPN?

Additionally the ping might be stucked in an old session on the fortigate. Please stop the ping, wait 30 seconds, then try it again (alternatively you can kill the session on the fortigate).

[waaalex]

Sylvia wrote:

tracert is denied because there is no matching policy for it (you are using udp-tracert).

ping: here I assume that you are using the wrong policy.

Do you configured an interface-or policy-based VPN?

Additionally the ping might be stucked in an old session on the fortigate. Please stop the ping, wait 30 seconds, then try it again (alternatively you can kill the session on the fortigate).

Hello.

The VPN is a tunneled mode vpn.

I may have a clue :

      There was already a vpn  site to site but all networks were not accessible.

      It works for all networks but not the new (200.200.4.0)

       This network is a routed network on Internet. My provider suggested me to make NAT 1 for 1 and hide the 200.200.4.0 with 192.168.200.0 for example.

Is this clue is ok?

I will make test and let you know if it's ok.

Thank you very much for help.

[Sylvia]

Ok, once again to make sure that we understand your situation:- you had one VPN tunnel in tunnel mode

- this VPN was working well and you could access the remote network without problems

- now you added another remote network to this VPN - is this correct?

- here RDP is working but not ICMP?

How did you add the new remote network? Addings selectors in phase2 and adding this network to the appropriate firewall policies?

I do not think that the PUBLIC network is the problem...

Please send more information (network map, phase2 configuration, fw policies etc). Otherwise is pretty difficult to help.

(and btw - is there a reason you use tunnel mode????)

Sylvia

[waaalex]

Hello Sylvia.

Sylvia wrote:

Ok, once again to make sure that we understand your situation:- you had one VPN tunnel in tunnel mode

- this VPN was working well and you could access the remote network without problems

- now you added another remote network to this VPN - is this correct?

- here RDP is working but not ICMP?

Yes that's it. I've got a test machine which is on two networks. One with a fully accessible network and one with the unaccessible. Ping is ok on the fully accessible but not on 200.200.4.0 (the new network) RDP is ok on 200.200.4.0

How did you add the new remote network? Addings selectors in phase2 and adding this network to the appropriate firewall policies?

YES :)

 

I do not think that the PUBLIC network is the problem...

Please send more information (network map, phase2 configuration, fw policies etc). Otherwise is pretty difficult to help.

Which commands can i put to answer your question? Because there is a lot of options for show and i can't insert more than one attachment.

(and btw - is there a reason you use tunnel mode????)

    The VPN was like this when i wanted to add the new network. There is no reason otherwise.     The firewall provider told me that it's better to use interface mode. 

Thank you

[Sylvia]

Ok, then I guess again, that icmp is using the wrong policy...

Start the ping, find the session in the session table and check the policy id.

Then try to figure out why icmp is using this policy id instead of the one for the vpn tunnel.

[waaalex]

Sylvia wrote:

Ok, then I guess again, that icmp is using the wrong policy...

Start the ping, find the session in the session table and check the policy id.

Then try to figure out why icmp is using this policy id instead of the one for the vpn tunnel.

THANK YOU !!!!! Finally i found the issue.

My rule in policy was AFTER the rule for ping to Internet.

I put the rule BEFORE and ping is now ok.

Thank you very much for time to help me.

:)