Site-to-Site VPN to AWS is up, but only one way connection

[simon0711]

I have established an S2S VPN tunnel from my FortiGate-100F to AWS VPC

I can ping from the EC2 to a local device but however, I cannot ping from a local device to my AWS EC2

I have already set up a static route and even tried the policy route but still no luck...

below is the config I have set

Much appreciate any help

Thanks in advance!

[Vichu_94 · Accepted solution]

Hi Simon,

To further troubleshoot the issue we would need to run the flow debug command on the CLI to check if the traffic is leaving the firewall or not 

di de flow filter clear
di de reset 
di de flow filter saddr x.x.x.x 
di de flow filter daddr y.y.y.y
di de flow filter proto 1
di de flow show function-name 
di de flow show iprope enable 

di de flow trace start 1000
di de en 

Where x.x.x.x is the source ip address and y.y.y.y is the destination ip address. After running the command, please try to initiate a ping from a test pc to the other site 

To disable the logs on the firewall, please run the command 

di de di

Refer link: https://docs.fortinet.com/document/fortigate/6.2.10/cookbook/54688/debugging-the-packet-flow

Regards

[simon0711]

Thanks for your reply, after debugging the packet flow, I am able to found out the problem, we have set wan1 as the out-going interface for my wifi VLAN which I think messed up the route, now I removed it from the policy route and it is working fine, thanks a lot for the tips!!!!