VPN Traffic not processed correctly to remote site

[rkulow]

hi there, i have problems with traffice flow trough ipsec vpn. scenario: site1 <----dialup VPN--->site2<---->subnet router<---->target subnets VPN is created with 1 phase1 setting and multiple phase2 settings for different dialup vpn's site1 ----> site2 and target subnets behind subnet router : works lan subnet from site2 fortigate ----> site1 : works target subnets behind subnet router ----> site1: doesnt work routing should be ok, otherwhise targetsubnets couldnt be reached firewall rules should be ok, because there are no drops in traffic flow log. debug flow log shows following: kvmv-gate-hq # id=20085 trace_id=2232 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, x.x.x.x:60547->x.x.x.x:9100) from lan. flag , seq 30861335, ack 0, win 8192" id=20085 trace_id=2232 func=init_ip_session_common line=4935 msg="allocate a new session-001efe4f" id=20085 trace_id=2232 func=vf_ip_route_input_common line=2584 msg="find a route: flag=00000000 gw-x.x.x.x via guestrow_4" id=20085 trace_id=2233 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, x.x.x.x:60554->x.x.x.x.x:80) from lan. flag , seq 1233968659, ack 0, win 8192" id=20085 trace_id=2233 func=init_ip_session_common line=4935 msg="allocate a new session-001efe57" id=20085 trace_id=2233 func=vf_ip_route_input_common line=2584 msg="find a route: flag=00000000 gw-x.x.x.x via guestrow_4" id=20085 trace_id=2234 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, x.x.x.x:60554->1x.x.x.x:80) from lan. flag , seq 1233968659, ack 0, win 8192" id=20085 trace_id=2234 func=init_ip_session_common line=4935 msg="allocate a new session-001efe5b" routing seems right to ipsec subinterface, but the packets wont be processed further. no encryption, no policy processing, no nat, etc. here some flow logs from traffice generated from lans subnet (directly attached to lan interface of fortigate in site2: kvmv-gate-hq # id=20085 trace_id=2381 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, x.x.x.x:59232->10.100.140.38:80) from lan. flag , seq 3043847260, ack 0, win 8192" id=20085 trace_id=2381 func=init_ip_session_common line=4935 msg="allocate a new session-001f0133" id=20085 trace_id=2381 func=vf_ip_route_input_common line=2584 msg="find a route: flag=04000000 gw-x.x.x.x via guestrow_4" id=20085 trace_id=2381 func=fw_forward_handler line=691 msg="Allowed by Policy-3:" id=20085 trace_id=2381 func=ipsecdev_hard_start_xmit line=157 msg="enter IPsec interface-guestrow_4" id=20085 trace_id=2381 func=esp_output4 line=859 msg="IPsec encrypt/auth" id=20085 trace_id=2381 func=ipsec_output_finish line=498 msg="send to x.x.x.x via intf-wan1" first 3 lines seems to be equal. only different is "finde a route: flag=" ("find a route: flag=00000000" doesnt work, "find a route: flag=04000000" works. seems that traffic will be routet not correctly. has anybody an idea how can rhis be fixed? thanks for your help