VPN site to site issues

[emerge]

I'm pretty new to the Fortigate firewalls and trying to figure out where I'm possibly going wrong with the VPN site to site I have setup with another company. I am able to make a healthy connection between both sites and the vpn connection shows active but there is no traffic showing between them.  The other company says that they are unable to ping one of my servers but I can see their ping test through the ipsec monitor in the incoming data.  I am unable to ping their side from the server.  I went into the CLI of the fortigate and did an execute ping to 3 of their networks and was able to ping all 3 of the IPs.  So it seems like I am able to successfully ping through the firewall, but If I ping from a device on the network I cannot reach their end and vice versa.  Hopefully someone can point me in the right direction on what to check as I am completely unfamiliar with these particular brand of firewalls.

[hubertzw]

Can you show the output from the below command?

diagnose sniffer packet any 'host X.X.X.X'

1) when you ping the partner IPs

2) when they try to ping your server

When you can ping them from FGT it can be routing or policy issue. Can you show your selectors (IP or subnet)? Are you sure the source IP of the host in your network is within the range you set on the FGT as the source?

[emerge]

Absolutely,

1) When I ping their network

 

TV-FW-60D # diag sniffer packet any "host 10.254.0.2"

interfaces=[any]

filters=[host 10.254.0.2]

 

0 packets received by filter

0 packets dropped by kernel

2) On their end a week ago the tech did a tcmpdump and stated that he see's a udp encapsulated ipsec packet sent to our WAN address and can see his ping traversing the vpn connection but no response packet

# tcpdump -nn net 172.21.1.0/24

23:29:42.788605 IP 10.33.0.9 > 172.21.1.7: ICMP echo request, id 31588, seq 1, length 64

23:30:03.973789 IP 10.33.0.9 > 172.21.1.7: ICMP echo request, id 31696, seq 1, length 64

# tcpdump -nn 'net 50.254.200.220'

23:29:42.788636 IP 10.33.252.205.4500 > 50.254.200.220.4500: UDP-encap: ESP(spi=0x170f4be0,seq=0xa), length 132

23:29:49.307656 IP 10.33.252.205.4500 > 50.254.200.220.4500: NONESP-encap: isakmp: phase 2/others ? inf

23:29:49.329883 IP 50.254.200.220.4500 > 10.33.252.205.4500: NONESP-encap: isakmp: phase 2/others ? inf

23:29:57.450404 IP 10.33.252.205.4500 > 50.254.200.220.4500: isakmp-nat-keep-alive

23:29:57.450550 IP 10.33.252.205.4500 > 50.254.200.220.4500: isakmp-nat-keep-alive

23:29:57.450670 IP 10.33.252.205.4500 > 50.254.200.220.4500: isakmp-nat-keep-alive

23:29:57.450830 IP 10.33.252.205.4500 > 50.254.200.220.4500: isakmp-nat-keep-alive

23:29:57.451292 IP 10.33.252.205.4500 > 50.254.200.220.4500: isakmp-nat-keep-alive

23:29:59.114239 IP 10.33.252.205.4500 > 50.254.200.220.4500: NONESP-encap: isakmp: phase 2/others ? inf

23:29:59.137438 IP 50.254.200.220.4500 > 10.33.252.205.4500: NONESP-encap: isakmp: phase 2/others ? inf

23:30:03.973823 IP 10.33.252.205.4500 > 50.254.200.220.4500: UDP-encap: ESP(spi=0x170f4be0,seq=0xb), length 132

I've attached an image of the Phase 2 selectors (using named address)

 

[rwpatterson]

You also need to have static routes in place for those remote networks that point down the tunnels. Make sure the distance is lower than the default gateway.

Also ensure that you have policies in place that start from your side for outgoing originating traffic as well as policies that start from the remote side for incoming originating traffic.

[hubertzw]

In the first post you said you can ping 3 IPs from the FGT but I don't see in the attached outputs. I'm asking for it just to be sure routing on the FGT is correct (Robert also mentioned about it in his last post).

Are the three IPs from the same subnet as the one in the last post (10.254.0.2)?

When you don't see any traffic you can check why:

diag debug flow filter addr 10.254.0.2 diag debug flow show console enable diag debug flow show function-name enable diag debug flow trace start 100 diag debug enable

Sometimes it's routing or missing policy. When you use VPN wizard all components are added automatically (routing, policies).

Usually you shouldn't be able to ping remote host from the FGT as it requires additional firewall policy. Do the test from the server, make sure the routing is correct pointing to the FGT and on the FGT you send traffic to the tunnel.