Site to Site Tunnel is up, no traffic

[kuku]

Hello,

ipsec/interface mode - site to site between 100D and 90D

tunnel is up but I'm unable to reach the remote network

I have policies and route on both units, and i can ping the remote network only from the Fortigate cli

but not from the network. The NAT is on the tunnel setting but i tried it also on the policies - did not work

on the logs P1 P2 is up - and cant see any errors on the logs

Anybody has any suggestions? Thank you.                                               

[Iescudero]

Hi there!

Can you post the vpn config from ike phase 1 and 2?

Also you can sniff a ping with the traffic from the cli using diagnose sniffer traffic VPN "icmp" 4, with this level of verbose you can see if the traffic actually is getting into the tunel.

[rwpatterson · Accepted solution]

Make sure that the tunnel route has a lower distance than the default. Trace traffic with the sniffer or flow. A simple traceroute from any workstation may also tell you where your traffic is headed.