VPN ipsec Remote Access up but no traffic

[HS08]

I try to build VPN remote access using ipsec to preparing upgrade my fortigate production from 7.2 to 7.6 on my lab.

My fortigate lab use version 7.6.4 and after i create vpn tunnel, the forti client is connected and get the ip address but the client is not able to reach to anywhere. The firewall policy and static routing was working fine.

Open case to the fortigate support and they also feel strange with this issue. Someone here can help how to toubleshoot?

Here my VPN config

===========================

config vpn ipsec phase1-interface
edit "VPN-RA"
set type dynamic
set interface "port1"
set ike-version 2
set peertype any
set net-device disable
set mode-cfg enable
set proposal aes128-sha1
set add-route disable
set comments "VPN Remote Access"
set dhgrp 5 20
set wizard-type dialup-forticlient
set transport auto
set fortinet-esp enable
set ipv4-start-ip 10.64.200.20
set ipv4-end-ip 10.64.200.50
set dns-mode auto
set save-password enable
set client-auto-negotiate enable
set client-keep-alive enable
set psksecret ENC xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
next
end

config vpn ipsec phase2-interface
edit "VPN-RA"
set phase1name "VPN-RA"
set proposal aes128-sha1
set dhgrp 5 20
set comments "VPN: VPN-RA -- Created by VPN wizard"
next
end

Here my routing

===========================

config router static
edit 1
set distance 1
set sdwan-zone "SDWAN_INTERNET"
next
edit 2
set dst 192.168.100.0 255.255.255.0
set gateway 192.168.100.1
set device "port2"
next
edit 3
set dst 10.64.200.0 255.255.255.0
set device "VPN-RA"
next
end

Here my firewall policies

===========================

config firewall policy
edit 3
set name "LAN to LAN"
set uuid 9be61642-ebbf-51f0-c819-41d789e59def
set srcintf "ss_vlan100" "ss_vlan110" "ss_vlan120" "ss_vlan140" "loopback" "VPN-RA"
set dstintf "ss_vlan100" "ss_vlan110" "ss_vlan120" "ss_vlan140" "loopback" "VPN-RA"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all
next
end

Here my forticleint status, i ping to my loopback interface but timeout

The routing was pushed to the client

[funkylicious]

https://docs.fortinet.com/document/fortigate/7.6.5/administration-guide/567401/dialup-ipsec-vpn-usin...

try and disable fortinet-esp command 

[HS08]

disabling the esp is not helping. I test when on forticlient connect using dns name then the forticlient is connected but not able to reach to anywhere.

But if i use ip address then i able to reach to anywhere, it's strange why can't reach to anywhere when use dns name.

[funkylicious]

i would do the following:

- confirm that traffic is hitting the firewall while the client is connected to the VPN, doing either tcpdump/sniffer or debug flow ( i would turn npu-offload under phase1 or firewall policy, off just to make sure that you have traffic - https://community.fortinet.com/t5/FortiGate/Technical-Tip-Ensuring-IPsec-traffic-is-offloaded-for-im... ) 

- then i would test with the command diagnose firewall iprope flush- https://community.fortinet.com/t5/FortiGate/Technical-Tip-Hidden-command-diagnose-firewall-iprope-fl... 

- if none of these work, then i wold reinstall FortiClient and rebuild the VPN profile in it and test again

https://community.fortinet.com/t5/FortiGate/Technical-Tip-No-bytes-are-received-when-connected-to-IP... 

[trhs1101]

I suspect you need to change the static route on your SD-WAN route. The distance is currently set to 1, change it to 10 as this is your default gateway presumably. 

[HS08]

How I can change the metric on sdwan? Checked static routing to the sdwan interface there is no metric.

[trhs1101]

You need to do it via the CLI. 

Open the CLI:
config router static

edit 1

set distance 10

[HS08]

cannot be changed, try change to 10 but always back to 1.

[trhs1101]

Apologies, just remembered that FortiGates SD-WAN routes can't be changed to 10 as it's the default for static routes. They can be changed to any other number though. Try changing it to 50.