VPN Only works between Gateways

[MegamanEXE]

Hello everyone Currently I am trying to make a VPN Site to Site between a Fortigate 90D and a TP-LINK TL-R600VPN however I am facing an issue in which the Fortigate CLI can make a ping to the private TP-LINK gateway (192.168.4.1), and one of the machines in the other subnet can make a ping to the fortigate gateway (192.168.3.1) however the PCs cant see each other (192.168.4.100 can´t see 192.168.3.23 and the contrary is also true). The route is set in Fortigate so that the connections to 192.168.4.0/24 go through the VPN, the question is, what is missing in the configuration so that the two PCs can ping each other? thanks in advance

[emnoc]

The distance shouldn' t matter, routing is exact match 1st before the default, but yes I believe his routing is missed up or the remote subnet encryption rules.

[MegamanEXE]

The TP-LINK side configures the routing automatically once you create the VPN and there isn' t a way to configure a distance on that router If I do the tracert from the 192.168.3.23 (Fortigate side) it gets stuck on the 192.168.3.1 IP of Fortigate, however, from the 192.168.4.100 of the TP-LINK side, the tracert goes through all of the VPN (4.1 to 3.1 to 3.23). So my understanding is that it may be a problem on Fortigate since it doesnt jump to the 192.168.4.1 Gateway... The routes make sense to me, but it may have something wrong (on either side)

[ede_pfau]

Why don' t you use the sniffer on the FGT to SEE whether traffic enters the tunnel or not? Better than guessing.

 diag deb ena
 diag sniffer packet any ' icmp'  4
 
 Ctrl-C to stop.

This with a permanent ping to the TP side.

[MegamanEXE]

As requested here is the sniffer, IP-A is public IP for Fortigate, IP-B is public for TP-LINK, as you can notice there is an IP that is not hidden due to being a Microsoft IP in the city of redmond, and it is not a known IP to our company. Why is it going there? CXRFTG # diag sniffer packet any ' icmp' 4 interfaces=[any] filters=[icmp] 8.632593 internal in 192.168.3.23 -> 192.168.4.100: icmp: echo request 8.632846 Castellana out 192.168.3.23 -> 192.168.4.100: icmp: echo request 8.632917 wan1 out 192.168.3.23 -> 192.168.4.100: icmp: echo request id=13 trace_id=1097 msg=" vd-root received a packet(proto=1, 192.168.3.23:1->192.168.4.100:8) from internal." id=13 trace_id=1097 msg=" allocate a new session-00bc1cda" id=13 trace_id=1097 msg=" find a route: gw-192.168.4.100 via Castellana" id=13 trace_id=1097 msg=" use addr/intf hash, len=4" id=13 trace_id=1097 msg=" Allowed by Policy-9:" id=13 trace_id=1097 msg=" enter IPsec interface-Castellana" id=13 trace_id=1097 msg=" send to IP-B via intf-wan1" id=13 trace_id=1097 msg=" encrypting, and send to IP-B with source IP-A" 13.615912 internal in 192.168.3.23 -> 192.168.4.100: icmp: echo request 13.616062 Castellana out 192.168.3.23 -> 192.168.4.100: icmp: echo request 13.616120 wan1 out 192.168.3.23 -> 192.168.4.100: icmp: echo request id=13 trace_id=1098 msg=" vd-root received a packet(proto=1, 192.168.3.23:1->192.168.4.100:8) from internal." id=13 trace_id=1098 msg=" Find an existing session, id-00bc1cda, original direction" id=13 trace_id=1098 msg=" enter IPsec interface-Castellana" id=13 trace_id=1098 msg=" send to IP-B via intf-wan1" id=13 trace_id=1098 msg=" encrypting, and send to IP-B with source IP-A" 15.061582 wan1 out IP-A -> 65.52.237.45: icmp: host IP-A unreachable 15.061637 wan1 out IP-A -> 65.52.237.45: icmp: host IP-A unreachable 15.061675 wan1 out IP-A -> 65.52.237.45: icmp: host IP-A unreachable

[ede_pfau]

Just ignore the pings to MS - used for determining Internet connectivity (on Win7). As for the sniffer trace: traffic is routed correctly into the tunnel, but there are no echo replies. So either - a (missing) policy on the TP side keeps this traffic from reaching the TP router or - the router replies but that traffic can' t make it out back through the tunnel. In short, look at the TP config.

[Marcelo_Souza]

Hello

Have you found a way to make the VPN IPSEC work between Fortigate and TL-R600VPN? 

Thanks.