Site to Site VPN

[Cornelis]

Hi All

I wonder if someone could help me

i have created a site to site vpn between two fortigates.

Site A

VLAN: 172.168.0.0/24

Polices created to allow all 

Site B 

LAN: 192.168.1.0/24

Polices created to allow all 

The tunnel comes up successfully and i am able to ping from site B to site A but whenever i try to ping from site a to b it fails, however i am able to rdp into a machine from site a to b

Any guidance would be grateful to get ping to work

Many thanks 

[Toshi_Esumi]

You already have Service: ALL enabled in the policies. Then if RDP works but can't ping the same machine, I would suspect the machine is not allowing ping while allowing RDP. But to make sure, I would run "diag packet sniffer" at Site-b FGT on the LAN interface.

[Cornelis]

Hi Toshi

Thank you for the reply, ping is enabled on the machine. when i run the command how do i do that on the lan interface, sorry still new to networking.

Many thanks

[Toshi_Esumi]

 diag sniffer packet <interface_name> 'host <ip_address_of_the_machine>'

depending on your FGT model, you might need to disable ASIC off-loading on the policy with below.

 config firewall policy

 edit <id>

 set auto-asic-offload disable

 end

If you do that, don't forget to enable it again once you're done sniffing.