Site to site VPN

[Tannv]

Hi,

I have configured vpn site to site between fortigate 60D(main office) and Cisco ASA 55xx(branch office), both sites can connect well.

I have tried to use Anyconnect to connect via Cisco ASA from home, After connected i can connect to all computer inside main office, but could not connect any computer at branch office.

I tried to ping from fortigate to Cisco ASA and vice versa but failed

Anyone can know the reason, how can i fix this?

Thanks a lot.

[emnoc]

The cli diag debug flow is your friend on a FGT. The  Packet-tracer on the cisco ASA is your friend. Run both of these and review the diagnostic output. You need route and fwpolicies and don't rule out any SNAT configurations.

Both of these  tools is your 1st line tool for trouble-shooting

Ken

[FortiKoala]

Have a look at this cookbook http://cookbook.fortinet.com/ipsec-fortigate-cisco/ it describes the setups

You might also want to troubleshoot the packet flow through the FortiGate http://kb.fortinet.com/kb/viewContent.do?externalId=FD31702

Make sure your ip address is not being denied by the firewall policies

[Deepakkhw]

Please check below details,

On Cisco ASA:

1. Cisco anyconnect subnet must be in nonat acl.

2. Anyconnect subnet must be on Crypto route map acl with destination subnet of your frotigate site. 

On Fortigate:

1. Anyconnect Subnet is allowed in Phase 2.

2. The policy is configured on FortiGate to allow traffic.

3. A route is configured for anyconnect subnet.

Regards,

Deepak Kumar