hi there,
i have problems with traffice flow trough ipsec vpn.
scenario:
site1 <----dialup VPN--->site2<---->subnet router<---->target subnets
VPN is created with 1 phase1 setting and multiple phase2 settings for different dialup vpn's
site1 ----> site2 and target subnets behind subnet router : works
lan subnet from site2 fortigate ----> site1 : works
target subnets behind subnet router ----> site1: doesnt work
routing should be ok, otherwhise targetsubnets couldnt be reached
firewall rules should be ok, because there are no drops in traffic flow log.
debug flow log shows following:
kvmv-gate-hq # id=20085 trace_id=2232 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, x.x.x.x:60547->x.x.x.x:9100) from lan. flag , seq 30861335, ack 0, win 8192"
id=20085 trace_id=2232 func=init_ip_session_common line=4935 msg="allocate a new session-001efe4f"
id=20085 trace_id=2232 func=vf_ip_route_input_common line=2584 msg="find a route: flag=00000000 gw-x.x.x.x via guestrow_4"
id=20085 trace_id=2233 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, x.x.x.x:60554->x.x.x.x.x:80) from lan. flag , seq 1233968659, ack 0, win 8192"
id=20085 trace_id=2233 func=init_ip_session_common line=4935 msg="allocate a new session-001efe57"
id=20085 trace_id=2233 func=vf_ip_route_input_common line=2584 msg="find a route: flag=00000000 gw-x.x.x.x via guestrow_4"
id=20085 trace_id=2234 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, x.x.x.x:60554->1x.x.x.x:80) from lan. flag , seq 1233968659, ack 0, win 8192"
id=20085 trace_id=2234 func=init_ip_session_common line=4935 msg="allocate a new session-001efe5b"
routing seems right to ipsec subinterface, but the packets wont be processed further. no encryption, no policy processing, no nat, etc.
here some flow logs from traffice generated from lans subnet (directly attached to lan interface of fortigate in site2:
kvmv-gate-hq # id=20085 trace_id=2381 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, x.x.x.x:59232->10.100.140.38:80) from lan. flag , seq 3043847260, ack 0, win 8192"
id=20085 trace_id=2381 func=init_ip_session_common line=4935 msg="allocate a new session-001f0133"
id=20085 trace_id=2381 func=vf_ip_route_input_common line=2584 msg="find a route: flag=04000000 gw-x.x.x.x via guestrow_4"
id=20085 trace_id=2381 func=fw_forward_handler line=691 msg="Allowed by Policy-3:"
id=20085 trace_id=2381 func=ipsecdev_hard_start_xmit line=157 msg="enter IPsec interface-guestrow_4"
id=20085 trace_id=2381 func=esp_output4 line=859 msg="IPsec encrypt/auth"
id=20085 trace_id=2381 func=ipsec_output_finish line=498 msg="send to x.x.x.x via intf-wan1"
first 3 lines seems to be equal. only different is "finde a route: flag=" ("find a route: flag=00000000" doesnt work, "find a route: flag=04000000" works.
seems that traffic will be routet not correctly.
has anybody an idea how can rhis be fixed?
thanks for your help
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1688 | |
1087 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.