What is wrong with my policy?

[raffaeledp]

Hello everybody, 

I'm working on a Fortigate 70G v7.2.11

I defined an interface: 

 

and a policy to allow the traffic:

 With this policy, I want to say: wherever I call you, you have to allow the traffic.

If I connect to any 70G interface (wifi, wired lan etc.), it works. I can ping 10.0.0.2.

There is only one interface for which this policy does not work:

 

It's the admin_tunnel (or the ipsec interface), an ipsec interface. I've already tested this ipsec tunnel for other scopes and it works fine. In fact, I already defined one policy:

 

The problem is that if I'm connected to this tunnel I can't ping 10.0.0.2 anymore.

Why is that? 

shouldn't the traffic I send out the tunnel just fall under any -> 70Gto60F (port5) the policy?

[AEK]

Hi Rafael

In traffic log, do you see any related traffic that is denied? (you need to enable logs for the implicit deny).

You may also try with this command and share the output.

diag sniffer packet any "icmp and host 10.0.0.2" 4

[dingjerry_FTNT]

Hi @raffaeledp ,

You need to run debug flow commands to see why the traffic was not working as expected.

Also, it's better to provide your FGT config and/or the routing table info as well.

BTW, why do you configure the IP on port5 as 10.0.0.2/30?  This is not normal for an internal interface.

[raffaeledp · Accepted solution]

Hello,

thanks everybody for the answers.

The solution was a lot easier than I thought.

During the sniffing process, I couldn't see any packet on that interface.

The problem was simply that the accesibile network segment defined for the ipsec tunnels didn't contain the 10.0.0.2 address.