Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Wazaq
New Contributor

ipsec site to site vpn

Hi,

i created a site to site vpn with a 4g router on each side and the fortinet router linked to it however the two fortinet routers can be seen since the vpn is up but the ping does not work. Both fortinet have the same configuration. I post you the fortinet conf image.

8 REPLIES 8
sw2090
SuperUser
SuperUser

Since you say the tunnel is up (the pic shows that too) I would recommed to the some flow debugging on one or evn both FGT involved in order to see what happens to your traffic going over the tunnel.

 

diag debug ena

diag debug flow filter clear

diag debug flow filter daddr <iponremotesubnet>

diag debug flow trace start 10000

 

then ping the Ip you specified in the filter from a client that should be able to piing it and watch the console.

You will see what happens to the traffic.

Once you see it went out over the tunnel, do the same on the opposite FGT.

Maybe with filter set to saddr <ipofclientyouarepinging from).

 

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
Wazaq
New Contributor

Thanks for your reply, I did the commands and ping and here are the results:

 

FGT50E5619045241 # id=20085 trace_id=1 func=print_pkt_detail line=5501 msg="vd-root:0 received a packet(proto=1, 192.168.0.10:1->192.168.3.10:2048) from lan. type=8, code=0, id=1, seq=17."

id=20085 trace_id=1 func=init_ip_session_common line=5666 msg="allocate a new session-000054e0" id=20085 trace_id=1 func=vf_ip_route_input_common line=2596 msg="find a route: flag=04000000 gw-192.168.3.10 via VEZIN-4G-4G" id=20085 trace_id=1 func=fw_forward_handler line=771 msg="Allowed by Policy-2: SNAT" id=20085 trace_id=1 func=__ip_session_run_tuple line=3286 msg="SNAT 192.168.0.10->192.168.1.253:60417" id=20085 trace_id=1 func=ipsecdev_hard_start_xmit line=777 msg="enter IPsec interface-VEZIN-4G-4G" id=20085 trace_id=1 func=ipsec_common_output4 line=876 msg="No matching IPsec selector, drop"

 

Is the VEZIN-4G-4G interface badly configured?

I have attached the network diagram.

sw2090

Looks like something is screwed up with your Tunnels phase2 IP selectors...

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
pmandava_FTNT
New Contributor III

Hi Wazaq,

 

It looks like you have the required firewall policy to allow the traffic but the matching Phase 2 selector is missing. Can you share the vpn configuration?

 

-prithvi

sw2090

Probably this is due to your NAT settings on the policy. The logs show the traffic gets SNATed before it goes to the IPSec tunnel. Maybe due to this the phase2 selectors do not match anymore?

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
Wazaq
New Contributor

The phase 2 is corect, just activate NAT in policies on remote subnet to LAN rule the problem is solved.

Wazaq
New Contributor

Hello, quick update, it was just necessary to deactivate the NAT of the lan to the remote.

Thanks for your help.

keixfred
New Contributor

hi, Wazaq

 

Maybe I want to do the same thing as you did before

 

I want to build a site to site VPN connection between two fortigate firewalls which are behind 4G router each side.

 

I have try to create it by template, and select "This site is behind NAT" 

 

But I cannot bring up the tunnel.

 

Hope you can share the configuration.

 

Thanks for your help

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors