Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Unable to route VPN traffic over interface to LAN network

Hello all! Apologies if this was asked/answered, spent time search but can't find a similar case. 


FW: FortiGate FG-200F on firmware v7.0.13.


We use a split tunnel IPSec VPN to allow access to specific subnets on our network for access to IT resources. We have a few up and working and they are accessible without issue. However all of those subnets are networks that are hosted by the FortiGate. 


I just stood up an OOB management network hosted by a UniFi UDM Pro firewall. What I'm trying to do is to allow secondary access to that network via the interface I configured to allow OOB access to the FortiGate. Here's what I've done:


  • Interface created in DMZ role, IP set to be within the network of the OOB network. If I open the FG CLI I can ping devices on the network without issue.
  • Subnet of the OOB network added to the address group that the "Accessible networks" is assigned to in the VPN tunnel configuration.
  • Firewall policy added to allow traffic from the VPN interface to the management network subnet. 

However traffic is not routing to the interface. I've also tried:


  • Static route for traffic for the OOB network to the interface that the network is connected to
  • Policy route for traffic originating from the VPN interface to the interface that the network is connected to

Still not able to route anything. I feel like I'm either missing something obvious or what I'm attempting to do won't work. Any pointers would be appreciated!


Could you please provide the output of the following commands

get router info routing-table details <ip you want to ping>


di sniffer packet any 'host <destination ip > and icmp' 4 0 

di de reset 

di de flow filter addr <destination ip>

di de flow show function-name enable

di de flow trace start 100

di de flow filter proto 1

di de en

run the ping to the destination IP from the computer

Also share the policy for this traffic


Amritpal Singh

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors