Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

VPN site to site issues

I'm pretty new to the Fortigate firewalls and trying to figure out where I'm possibly going wrong with the VPN site to site I have setup with another company. I am able to make a healthy connection between both sites and the vpn connection shows active but there is no traffic showing between them.  The other company says that they are unable to ping one of my servers but I can see their ping test through the ipsec monitor in the incoming data.  I am unable to ping their side from the server.  I went into the CLI of the fortigate and did an execute ping to 3 of their networks and was able to ping all 3 of the IPs.  So it seems like I am able to successfully ping through the firewall, but If I ping from a device on the network I cannot reach their end and vice versa.  Hopefully someone can point me in the right direction on what to check as I am completely unfamiliar with these particular brand of firewalls.

Contributor III

Can you show the output from the below command?


diagnose sniffer packet any 'host X.X.X.X'


1) when you ping the partner IPs

2) when they try to ping your server


When you can ping them from FGT it can be routing or policy issue. Can you show your selectors (IP or subnet)? Are you sure the source IP of the host in your network is within the range you set on the FGT as the source?




1) When I ping their network

TV-FW-60D # diag sniffer packet any "host"
0 packets received by filter
0 packets dropped by kernel


2) On their end a week ago the tech did a tcmpdump and stated that he see's a udp encapsulated ipsec packet sent to our WAN address and can see his ping traversing the vpn connection but no response packet

# tcpdump -nn net
23:29:42.788605 IP > ICMP echo request, id 31588, seq 1, length 64
23:30:03.973789 IP > ICMP echo request, id 31696, seq 1, length 64
# tcpdump -nn 'net'
23:29:42.788636 IP > UDP-encap: ESP(spi=0x170f4be0,seq=0xa), length 132
23:29:49.307656 IP > NONESP-encap: isakmp: phase 2/others ? inf
23:29:49.329883 IP > NONESP-encap: isakmp: phase 2/others ? inf
23:29:57.450404 IP > isakmp-nat-keep-alive
23:29:57.450550 IP > isakmp-nat-keep-alive
23:29:57.450670 IP > isakmp-nat-keep-alive
23:29:57.450830 IP > isakmp-nat-keep-alive
23:29:57.451292 IP > isakmp-nat-keep-alive
23:29:59.114239 IP > NONESP-encap: isakmp: phase 2/others ? inf
23:29:59.137438 IP > NONESP-encap: isakmp: phase 2/others ? inf
23:30:03.973823 IP > UDP-encap: ESP(spi=0x170f4be0,seq=0xb), length 132

I've attached an image of the Phase 2 selectors (using named address)
Valued Contributor III

You also need to have static routes in place for those remote networks that point down the tunnels. Make sure the distance is lower than the default gateway.


Also ensure that you have policies in place that start from your side for outgoing originating traffic as well as policies that start from the remote side for incoming originating traffic.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at:

Bob - self proclaimed posting junkie!See my Fortigate related scripts at:

In the first post you said you can ping 3 IPs from the FGT but I don't see in the attached outputs. I'm asking for it just to be sure routing on the FGT is correct (Robert also mentioned about it in his last post).

Are the three IPs from the same subnet as the one in the last post (


When you don't see any traffic you can check why:


diag debug flow filter addr diag debug flow show console enable diag debug flow show function-name enable diag debug flow trace start 100 diag debug enable


Sometimes it's routing or missing policy. When you use VPN wizard all components are added automatically (routing, policies).


Usually you shouldn't be able to ping remote host from the FGT as it requires additional firewall policy. Do the test from the server, make sure the routing is correct pointing to the FGT and on the FGT you send traffic to the tunnel.






Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors