I have 2 offices, Site A is Sophos and Site B is Fortigate. I have established Site-To-Site VPN for the two sites. The tunnel between the two sites is UP, but the Tunnel Interface IP cannot ping each other and the two sites cannot ping each other. The server under the site cannot ping the opposite endpoint.
The following is relevant information:
Site A (Sophos)
Site B (Fortigate)
(Below Fortigate IPSec Tunnel Status)
Here I'm using Route-based to establish a Site-To-Site VPN connection, I've also tried Policy-based, but neither worked, and I'm not sure if I'm missing any settings.
I can't ping from the tunnel interface 10.212.0.1 to 10.212.0.6, nor does the reverse ping from 10.212.0.6 to 10.212.0.1.
and i tried the mtr from server, according to the server's mtr tracking, the data will stop at Fortigate's LAN Gateway
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
While pinging the destination, try the following commands to see if the packet flows through the right interfaces:
diag sniffer packet any "host x.x.x.x and icmp" 4
And try the below to see why it is blocked (if so):
diag debug flow filter addr x.x.x.x
diag debug flow filter proto 1
diag debug console timestamp enable
diag debug flow show iprope enable
diag debug flow show function-name enable
diag debug flow trace start 100
diag debug enable
And in firewall policies as well, and from both sides.
Hi @dbhavsar
I have added the relevant IP address to the Firewall. I think it should be allowed, and the Phase 2 status is up. Is there any recommended way to check it?
In Fortigate, I have set up the Firewall Policy as follows, in which I include Interfaces using Zone.
Internal-LAN is server ip subnet interface, internal-S2S-OF is IPSec tunnel interface.
Sophos & Fortigate pretty much open up bidirectional firewall rules, except Sophos specifies the LAN IP and tunnel interface IP for both endpoints.
This troubleshooting tip shpuld help.
Hi @AEK
I conducted troubleshooting based on this document(https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPSec-VPN-with-Sophos-is-not-working...), and it seems that the IKE Phase1 & Phase2 processes are smooth and there are no errors.
below are logs:
ike V=root:0:S2S_DCOF_M: link is idle 7 x.x.x.x(Fortigate WAN IP)->y.y.y.y(Sophos WAN IP):0 dpd=2 seqno=340 rr=0
ike V=root:0: comes y.y.y.y(Sophos WAN IP):500->x.x.x.x(Fortigate WAN IP):500,ifindex=7,vrf=0,len=80....
ike V=root:0: IKEv2 exchange=INFORMATIONAL id=8fdf995bf1a69d32/290c6f562da113ca:0000002a len=80
ike 0: in 8FDF995BF1A69D32290C6F562DA113CA2E2025000000002A0000005000000034E994E227B57A748E3C828E5510C2B08CA88979C167810B9AFF0A50C6BA984305B308DA3ACA67E990112A881C7AFDDF43
ike V=root:0:S2S_DCOF_M: HA state master(2)
ike 0:S2S_DCOF_M:15: dec 8FDF995BF1A69D32290C6F562DA113CA2E2025000000002A0000002000000004
ike V=root:0:S2S_DCOF_M:15: received informational request
ike 0:S2S_DCOF_M:15: enc 0F0E0D0C0B0A0908070605040302010F
ike 0:S2S_DCOF_M:15: out 8FDF995BF1A69D32290C6F562DA113CA2E2025280000002A000000500000003447D3FC98E47D420E5CEB95835779AFCBE67845F2E289A8639D2CC9A80897B7E26506A0C4477F635BFA6F2DAFF41F27E8
ike V=root:0:S2S_DCOF_M:15: sent IKE msg (INFORMATIONAL_RESPONSE): x.x.x.x(Fortigate WAN IP):500->y.y.y.y(Sophos WAN IP):500, len=80, vrf=0, id=8fdf995bf1a69d32/290c6f562da113ca:0000002a, oif=7
I would check the TTL and encryptions setting for phase1 and 2 matches between the two. I have stumbled over something similar between Sophos and Mikrotik. Tunnel was up but no traffic was forwarded
/Lennart
Checked that the TTL and encryption settings for Phase 1 and Phase 2 match between the two.
I captured the packet on Fortigate earlier, but I did not receive the ESP packet. I am checking the source of the problem in detail.
While pinging the destination, try the following commands to see if the packet flows through the right interfaces:
diag sniffer packet any "host x.x.x.x and icmp" 4
And try the below to see why it is blocked (if so):
diag debug flow filter addr x.x.x.x
diag debug flow filter proto 1
diag debug console timestamp enable
diag debug flow show iprope enable
diag debug flow show function-name enable
diag debug flow trace start 100
diag debug enable
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1702 | |
1092 | |
752 | |
446 | |
229 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.