Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Using SNAT before L2L

Hello Fortinet Forum!


I've ran into an issue with NAT and usually it just works. I hope you can help me out.


I have two Fortigates (A and B) with site-to-site VPN between them.


Fortigate A needs to be NATed from to Therefore I've created a IP Pool as follows;

Type: Overload

External IP Range: -

ARP reply: tick


Fortigate B have LAN


My policy is as follows;

Incoming Interface: Interface mastering

Outgoing Interface: site-to-site interface



Service: ALL

Action: Accept

NAT: Enabled

IP Pool Configuration: Use Dynamic IP Pool (The overload mentioned above)


The site-to-site phase 2 have the following

Local Address: (The NATed address)

Remote Address:


The site-to-site is state UP.


I run the following diagnose command to troubleshoot;

diagnose debug enable

diagnose debug flow filter addr

diagnose debug flow trace start 100


The outcome of those diagnose commands is;

id=20085 trace_id=246 func=print_pkt_detail line=5519 msg="vd-root:0 received a packet(proto=1,> from local. type=8, code=0, id=14848, seq=0." id=20085 trace_id=246 func=init_ip_session_common line=5684 msg="allocate a new session-01ce3079" id=20085 trace_id=246 func=ipsecdev_hard_start_xmit line=692 msg="enter IPsec interface-L2L" id=20085 trace_id=246 func=ipsec_common_output4 line=804 msg="No matching IPsec selector, drop"


I know the "No matching IPsec selector, drop" means that it doesn't match in my IPsec phase 2 but it would if the NAT worked as I was told, it would match.


As far as I know the network packet should match the source and destination in the policy. Then be NATed before entering the IPsec tunnel but in the diagnose output it doesn't look like it's being NATed.

received a packet(proto=1,>


Can someone give me a hint?

Esteemed Contributor III

Do you have a vpn estaghlisted


  diag vpn tunnel list


diagnose shows that is part of the issue or should be check. You can also tell when this is working of you do a


   diag sniffer packet <named rt interface for vpn>


If your ipsecSA is up and the nat is working, the src-ip would be


Ken Felix





PCNSE NSE StrongSwan

Thanks your your reply emnoc!


Doing diag vpn tunnel list shows me the SA's and the one with src:, dst: is there. The IPSec Monitor also shows all phase 2's UP.


Doing diag sniffer packet <tunnel interface> shows that I try to send and echo request, if I do it from the firewall with;

exe ping-options source

exe ping


If I ping from a client on the subnet and pings towards the nothing shows in the diag sniffer packet <tunnel interface> output regarding the ping.

If I use the policy lookup feature in the webinterface.

From: interface

To: Tunnel interface



It highlights the correct policy where I've put my IP Pool/NAT.


NAT interesting traffic with IPSEC L2L How do I NAT interesting traffic going through a L2L tunnel? The NAT'ing happens on the same router that it the L2L tunnel terminates on. Below is the config for the two routers. I have an ISP in between, but everything is routing and working correctly w/o the NAT. Once I enable the NAT, my tunnel breaks. All other traffic needs to PAT to an interface, I have a NAT exemption, for the LAN of the L2L, and built a separate SNAT for the VPN L2L traffic. jalsha moviesz

Esteemed Contributor III

Diag debug flow , did you use it? What's probably happening


1: client is not routing to the fw




2: or a higher preference fwpolicy is taking action before the policy that uses the vpn, so I bet your traffic is not going out the vpn tunnel but rather the wan



Ken Felix




PCNSE NSE StrongSwan
New Contributor

I am aslo facing the same error so Kindly please help me to find  a solution

VidMate Momix Download Vidmate


Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors