SSVPN using Fortigate 61E

[technician]

Hi, just successfully setup SSVPN between a Fortigate 61E (main office) and Cisco ASA (branch office). I can see on the Fortigate connection is up. Below are the details of the config:

1. ensure correct peer or remote WAN IP and correct interface

2. ensure correct preshared key

Phase 1: AES256 SHA1, DH-Group 5, Key lifetime: 28800

Phase 2: AES256 SHA 1, DH-Group 5, Key Lifetime: 3600

both enable replay detection and perfect forwars secrecy are ticked

The issue is from the Cisco ASA (branch office) I can ping the remote subnet, I can do RDP, I can do File and Printer Sharing but vice versa from the Fortigate (main office) I can't do what the branch office is doing. I checked the traffic log onn the Fortigate under Policy, I see the incoming traffic has values and increasing but the outgoing policy is 0 zero. So this explains why I can't do what branch office is doing. As of the moment, I'm not sure if is the problem on the Fortigate or ASA. 

Did some tracert's I tracert from Cisco ASA or any computers from the branch office to any computers in the main office and my first hop is the local IP of the Fortigate in main office. 

But when I do a tracert from the FG61E (main office) to any computers in the CiscASA (branch office), instead of going to the tunnel, 1st hop is the FG local interface then 2nd hop is the WAN IP of the FG 

Any suggestions? or what I can check for troubleshooting?

Thanks

Jeff

[MattM]

Do you have a static route setup in the Forigate for the remote subnet?

[technician]

oh, yeah totally forgot to include that in my first message. I do have a static route. The first static route is a default:

0.0.0.0 0.0.0.0 WAN IP (main office)

192.168.x.x (branch office local IP) SSVPN tunnel interface

Thanks

Jeff