ipsec site to site vpn

[Wazaq]

Hi,

i created a site to site vpn with a 4g router on each side and the fortinet router linked to it however the two fortinet routers can be seen since the vpn is up but the ping does not work. Both fortinet have the same configuration. I post you the fortinet conf image.

[sw2090]

Since you say the tunnel is up (the pic shows that too) I would recommed to the some flow debugging on one or evn both FGT involved in order to see what happens to your traffic going over the tunnel.

diag debug ena

diag debug flow filter clear

diag debug flow filter daddr <iponremotesubnet>

diag debug flow trace start 10000

then ping the Ip you specified in the filter from a client that should be able to piing it and watch the console.

You will see what happens to the traffic.

Once you see it went out over the tunnel, do the same on the opposite FGT.

Maybe with filter set to saddr <ipofclientyouarepinging from).

[Wazaq]

Thanks for your reply, I did the commands and ping and here are the results:

FGT50E5619045241 # id=20085 trace_id=1 func=print_pkt_detail line=5501 msg="vd-root:0 received a packet(proto=1, 192.168.0.10:1->192.168.3.10:2048) from lan. type=8, code=0, id=1, seq=17."

id=20085 trace_id=1 func=init_ip_session_common line=5666 msg="allocate a new session-000054e0" id=20085 trace_id=1 func=vf_ip_route_input_common line=2596 msg="find a route: flag=04000000 gw-192.168.3.10 via VEZIN-4G-4G" id=20085 trace_id=1 func=fw_forward_handler line=771 msg="Allowed by Policy-2: SNAT" id=20085 trace_id=1 func=__ip_session_run_tuple line=3286 msg="SNAT 192.168.0.10->192.168.1.253:60417" id=20085 trace_id=1 func=ipsecdev_hard_start_xmit line=777 msg="enter IPsec interface-VEZIN-4G-4G" id=20085 trace_id=1 func=ipsec_common_output4 line=876 msg="No matching IPsec selector, drop"

Is the VEZIN-4G-4G interface badly configured?

I have attached the network diagram.

[sw2090]

Looks like something is screwed up with your Tunnels phase2 IP selectors...

[pmandava_FTNT]

Hi Wazaq,

It looks like you have the required firewall policy to allow the traffic but the matching Phase 2 selector is missing. Can you share the vpn configuration?

-prithvi

[sw2090]

Probably this is due to your NAT settings on the policy. The logs show the traffic gets SNATed before it goes to the IPSec tunnel. Maybe due to this the phase2 selectors do not match anymore?

[Wazaq]

The phase 2 is corect, just activate NAT in policies on remote subnet to LAN rule the problem is solved.

[Wazaq]

Hello, quick update, it was just necessary to deactivate the NAT of the lan to the remote.

Thanks for your help.

[keixfred]

hi, Wazaq

Maybe I want to do the same thing as you did before

I want to build a site to site VPN connection between two fortigate firewalls which are behind 4G router each side.

I have try to create it by template, and select "This site is behind NAT" 

But I cannot bring up the tunnel.

Hope you can share the configuration.

Thanks for your help