Site to site vpn tunnel

[asnes]

I have been facing an issue with a site to site tunnel between a Fortigate and a Checkpoint. Site A has the Fortigate and Site B has the Checkpoint. This tunnel exists because we want users from Site B to have remote access(RDP) to site A. The tunnel was working properly and users were able to access the remote server normally, but as of yesterday this issue reappeared. The weird thing is that the tunnel is active, as shown both on Checkpoint and Fortigate web page, but I can't ping / RDP to the remote server. From Site A I can tracert the public IP of Site B but not the other way around, the only hop I get, is the on from the private IP of the firewall of Site B and the rest are empty. I am not that familiar with firewalls and in need of assistance. I can provide additional information about the setup and important information that would assist with the resolution of the issue.

[djp]

Either session stuck in the incorrect outbound session table, thus needing a blackhole route.
Or NATT needs to be forced as ISP may have put you behind some cgnat or other device

[Toshi_Esumi]

Before speculating what might have happened when you've lost connection from Site B to Site A, you need to confirm a couple of things. Since Site B is Checkpoint, I can't use that side to confirm the current status.
First, run a CLI command
   get vpn ipsec tun sum | grep [IPsec_phase1_name]

You would get like below:
   FortiGate-60F # get vpn ipsec tun sum | grep ny-tos1
   'ny-tos1' 207.232.95.65:0 selectors(total,up): 1/1 rx(pkt,err): 21842/0 tx(pkt,err): 21886/3

This IPsec has only one phase2 so (total,up)=1/1. If you have multiple phase2s, you should see more than 1. If total=up, all phase2 tunnels are up. 

Then the next step is if the FGT at Site A is actually receiving packets from a Site B device (ping or RDP, doesn't matter) by sniffing traffic with the destination device IP at Site A. The command is like below:

   diag sniffer packet any 'host [destination_IP] and icmp (or port 3389)' 4 0

Since it suddenly stopped working, I assume the policy hasn't changed. So if the FGT is receiving those packets, they should show up in the sniffing and at least it should be sent to the outgoing (LAN) interface. You most unlikely can't see it's coming in from the IPsec VPN interface unless you disable NPU offloading. 
To do that, you need to configure  
   set auto-asic-offload disable
on the incoming policy. If you do this, don't forget to re-enable the offloading after done sniffing. It would affect the performance.

If you determined that it's not coming in the FGT, something happened to the Checkpoint, which I'm suspecting. Then you need to troubleshoot on the Checkpoint. You likely need to ask help on the Checkpoint side.

Toshi