HI,
please help me as after update to fortios 7.0.13 site to site vpn site1 is E100 and site 2 E30 the VPN connection is up but no any traffic or services working between the 2 sities
Thanks,
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi,
- Was the upgrade done on both Site1 and Site2?
- Does the issue gets resolved when you downgrade to older version such as 7.0.12?
- Have you tried to check the sniffer for the communication on both the Firewall?
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Packet-capture-sniffer/ta-p/198313
- Is it possible to disable the NP offload and verify if the issue is still seen in 7.0.13? You may have to flap the VPN once the settings are changed.
https://docs.fortinet.com/document/fortigate/7.0.13/hardware-acceleration/636026
Regards,
Shiva
@m_esmat25
Are you using any type of ippool or vip for specific vpn tunnels?
Please check this link for more info about change in behavior:
Technical Tip: ARP reply setting in Virtual IP/IP ... - Fortinet Community
Regards,
Hi @m_esmat25,
In addition to @xshkurti, reply, you can run debug flow when try to pass traffic through the tunnel and see if reply traffic sent to "root" instead:
diag debug reset
diag debug flow filter addr X.X.X.X (source or destination IP)
diag debug flow filter proto 1
diag debug flow show ip en
diag debug flow show func en
diag debug console time ena
diag debug ena
diag debug flow trace start 999
Regards,
Minh
Thanks for all, and i will downgrade to older version 7.0.12 and check the iusse .
You can also be able to understand if the pack is going out of one FortiGate to another FortiGate and understand by running the sniffer as well.
diagnose sniffer packet any "host a.a.a.a and icmp" 6 0 a
Where a.a.a.a is the destination IP address to where you are initiating the ping to
You will be able to understand the issue is happening from which FortiGate and troubleshoot accordingly.
Hello @m_esmat25
If Phase2 is up but traffic is not passing.
1) Make sure the quick mode selector defined in Phase2 is configured properly to allow the traffic flow.
2) Check the IPv4 policies and confirm:
a) If there is policy defined for this traffic flow.
b) If there are any source and destination addresses defined, make sure it is configured to allow this traffic flow.
please check this document for reference
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Troubleshooting-IPsec-Site-to-Site-T...
let us know if you have any queries.
Thanks,
Pavan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1531 | |
1028 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.