Site-to-Site No Longer Passing Traffic

[itkzombie]

I have a site-to-site VPN setup between two Fortigate fws. This VPN has been setup for years and have had no issues. Yesterday, I lost the ability to communicate to either LAN between the VPN. The tunnel shows as up on both sides and I've tried rebooting, resetting the connection, and still nothing. Before yesterday I could communicate successfully between both sites but now nothing. It is also an IPsec VPN. Any ideas?

I also have other VPNs on each firewall (none other are Site to Sites) and they each work.

Version 5.6 on one side and 7.4.3 on the other.

[kaman]

Hi itkzombie,

As you informed IPSsec tunnel is up and you facing an issue of traffic through the tunnel is not working

Please provide the following CLI commands output on both the firewall:

get system status
get router info routing all
diag vpn tunnel list name <IPSec tunnel name>

Provide the given debug flow command when you generate traffic

diag debug reset
diag debug en
diag debug flow filter saddr x.x.x.x
diag debug flow filter daddr y.y.y.y
diag debug flow show function-name en
diag debug flow trace start 255
diagnose debug console timestamp enable

Where x.x.x.x is Source IP and y.y.y.y is Destination IP

Once you collected the debug output, disable debug with

diag debug reset
diag debug dis

CLI2:
Ping the destination IP address and run the below command on both firewalls and see the incoming and outgoing packets:

diagnose sniffer packet any ' host x.x.x.x and host y.y.y.y ' 6 0 l

Where x.x.x.x is Source IP and y.y.y.y is Destination IP

Please refer to the below documents for more information:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-VPN-is-up-but-network-is-not-r...
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-Tunnel-up-but-no-traffic-is-be...

Regards,
Aman

[dingjerry_FTNT]

Hi @itkzombie ,

My first step would be to use Ping to check it:

1) Run the following command on both FGTs:

diag sniffer packet any 'icmp and host x.x.x.x' 4

The x.x.x.x IP is the one you are Pinging.  Do not run continuous Ping.

2) If you do not see it entering into the local FGT or not leaving the remote FGT, run the debug commands on the one with the issue to tell why:

diag debug flow show iprope enable

diag debug flow filter proto 1

diag debug flow filter addr x.x.x.x

diag debug flow trace start 20

diag debug enable

Then initiate a Ping to reproduce the issue.

Again, please do not run continuous Ping.

3) You may also need to run the IKE debug on both FGTs:

diag debug application ike -1

diag debug enable