ipsec tunnel up but no return traffic from palo alto firewall

[jomfra]

Hello Expert,

I was able to successfully create an IPsec tunnel between Palo alto and my FortiGate.

I am seeing ping and http traffic success leaving my FortiGate but the return traffic is being deny 

below is details of a deny packet

General

Absolute Date/Time	2022-11-03 16:00:53
Last Access Time	16:00:53
Duration	0
Session ID	47,180
VDOM	root
NAT Translation	noop

Source

Source	192.168.150.204
Source Country/Region	Reserved
Source Interface	BOG_Lan (internal1)

Destination

Destination	192.168.142.201
Destination Country/Region	Reserved

Application Control

Application Name	icmp/0/0
Category	unscanned
Protocol	1
Service	icmp/0/0

Data

Received Bytes	0 B
Received Packets	0
Sent Bytes	0 B
Sent Packets	0

Action

Action	accept
Security Action
Policy ID	Implicit Deny
Policy Type	Firewall

Security

Level

notice

Cellular

Service

icmp/0/0

Other

Log event original timestamp	1667505653641792800
Timezone	-0400
Log ID	0000000013
Type	traffic
Sub Type	forward
Identifier	21
Source Interface Role	lan
Destination Interface Role	undefined

I humbly request some assistance to vet the deny message and provide some guidance.

Regards

[aionescu]

Hi @jomfra , welcome to the community.

Can you, please, check if there is a policy that allows the traffic, (ICMP traffic, in the provided example) from interface BOG_Lan (internal1) towards the tunnel interface? 

[jomfra]

Hello aionescu,

The are two policy in place see below for the details

BOG_PROD1 (1) # show
config firewall policy
edit 1
set name bog_out
set uuid 06077bd6-2ae1-51ed-de80-ac765ef0ed51
set srcintf internal1
set dstintf RBGL_BOG
set action accept
set srcaddr all
set dstaddr all
set schedule always
set service ALL
set logtraffic all
next
end
BOG_PROD1 (3) # show
config firewall policy
edit 3
set name bog _in
set uuid 635932ac-2ae1-51ed-4385-80b8c9763605
set srcintf RBGL_BOG
set dstintf internal1
set action accept
set srcaddr all
set dstaddr all
set schedule always
set service ALL
set logtraffic all
set comments (Copy of bog_out) (Reverse of bog_out)
next
end

BOG_PROD1 (3)