Hello Fortinet Forum!
I've ran into an issue with NAT and usually it just works. I hope you can help me out.
I have two Fortigates (A and B) with site-to-site VPN between them.
Fortigate A needs to be NATed from 192.168.100.0/24 to 10.10.100.253. Therefore I've created a IP Pool as follows;
Type: Overload
External IP Range: 10.10.100.253 - 10.10.100.253
ARP reply: tick
Fortigate B have LAN 192.168.254.0/24
My policy is as follows;
Incoming Interface: Interface mastering 192.168.100.0/24
Outgoing Interface: site-to-site interface
Source: 192.168.100.0/24
Destination: 192.168.254.0/24
Service: ALL
Action: Accept
NAT: Enabled
IP Pool Configuration: Use Dynamic IP Pool (The overload mentioned above)
The site-to-site phase 2 have the following
Local Address: 10.10.100.0/24 (The NATed address)
Remote Address: 192.168.254.0/24
The site-to-site is state UP.
I run the following diagnose command to troubleshoot;
diagnose debug enable
diagnose debug flow filter addr 192.168.100.1
diagnose debug flow trace start 100
The outcome of those diagnose commands is;
id=20085 trace_id=246 func=print_pkt_detail line=5519 msg="vd-root:0 received a packet(proto=1, 192.168.100.1:14848->192.168.254.1:2048) from local. type=8, code=0, id=14848, seq=0." id=20085 trace_id=246 func=init_ip_session_common line=5684 msg="allocate a new session-01ce3079" id=20085 trace_id=246 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-L2L" id=20085 trace_id=246 func=ipsec_common_output4 line=804 msg="No matching IPsec selector, drop"
I know the "No matching IPsec selector, drop" means that it doesn't match in my IPsec phase 2 but it would if the NAT worked as I was told, it would match.
As far as I know the network packet should match the source and destination in the policy. Then be NATed before entering the IPsec tunnel but in the diagnose output it doesn't look like it's being NATed.
received a packet(proto=1, 192.168.100.1:14848->192.168.254.1:2048
Can someone give me a hint?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Do you have a vpn estaghlisted
diag vpn tunnel list
diagnose shows that is part of the issue or should be check. You can also tell when this is working of you do a
diag sniffer packet <named rt interface for vpn>
If your ipsecSA is up and the nat is working, the src-ip would be 10.10.100.253
Ken Felix
PCNSE
NSE
StrongSwan
Thanks your your reply emnoc!
Doing diag vpn tunnel list shows me the SA's and the one with src: 10.10.100.0/24, dst: 192.168.254.0/24 is there. The IPSec Monitor also shows all phase 2's UP.
Doing diag sniffer packet <tunnel interface> shows that I try to send and echo request, if I do it from the firewall with;
exe ping-options source 192.168.100.1
exe ping 192.168.254.1
If I ping from a client on the 192.168.100.0/24 subnet and pings towards the 192.168.254.0/24 nothing shows in the diag sniffer packet <tunnel interface> output regarding the ping.
If I use the policy lookup feature in the webinterface.
From: 192.168.100.0/24 interface
To: Tunnel interface
Source: 192.168.100.1
Destination: 192.168.254.1
It highlights the correct policy where I've put my IP Pool/NAT.
Created on 04-06-2020 12:17 AM Edited on 04-13-2022 01:51 PM
NAT interesting traffic with IPSEC L2L How do I NAT interesting traffic going through a L2L tunnel? The NAT'ing happens on the same router that it the L2L tunnel terminates on. Below is the config for the two routers. I have an ISP in between, but everything is routing and working correctly w/o the NAT. Once I enable the NAT, my tunnel breaks. All other traffic needs to PAT to an interface, I have a NAT exemption, for the LAN of the L2L, and built a separate SNAT for the VPN L2L traffic. https://vidmateapp.win jalsha moviesz
Diag debug flow , did you use it? What's probably happening
1: client is not routing to the fw
or
2: or a higher preference fwpolicy is taking action before the policy that uses the vpn, so I bet your traffic is not going out the vpn tunnel but rather the wan
Ken Felix
PCNSE
NSE
StrongSwan
I am aslo facing the same error so Kindly please help me to find a solution
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1688 | |
1087 | |
752 | |
446 | |
227 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.