ipsec vlan s2s loopback port not responding

[hbuenafe81]

Gentleman,

I need support, show below that port 2601 on server that is map on loopback 10.2.202.10 is getting reset, but going direct to server port is open. 

Need some help why going to loopback is resetting. 

[hbuenafe81]

Hi ozkanaltas,

yes, you are correct that 10.2.202.10 is natted on router side, however the server port is not reachable if no nat on fortigate. This only happen on s2s setup.

note: 10.2.202.10 is directed natted to DMZ server. I created a sample below on router to avoid any impact on port 2601 as it use on prod.

ip nat inside source static tcp 10.3.131.160 7000 10.2.202.10 1205 extendable 

If I will not create a Nat on Fortigate it will not reach to server.

[hbuenafe81]

Hi Ozkanaltas,

Below debug if not nated to fortigate. Hope this help. 

[ozkanaltas]

Hi @hbuenafe81 ,

Sorry for my late reply.

Can you try without an AV profile on your policy? That line "Send to IPS" is related to the AV profile.

[hbuenafe81]

Hi Ozkanaltas,

Still same when i try to remove AV, i deleted create new policy with no restriction, below screenshot for your perusal. Btw, I've just notice that the its not reaching to the server if i will not create policy (10.2.202.10) nated to fortigate. If I nat it to fortigate them we get that message = outdev-unknown

[ozkanaltas]

Hello @hbuenafe81 ,

This debug output it seems without any problem.

Do you have a route on the router for return traffic?

And also can you try to configure source nat on the router for that traffic? Traffic seems to work asymmetrically.

[hbuenafe81]

Thanks for the prompt response.. Below trace and config showing that server is reachable from loopback and vice versa.

[ozkanaltas]

Hi @hbuenafe81 ,

I am not good at Cisco configuration but these nat rules seem like dnat rules. 

Can you try source nat for that traffic? 

Also, why do you need nat traffic on the router? You can access your server directly from FortiGate. If you want to hide your IP address from the remote side you can also do this on FortiGate with VIP object.

In your scenario, your traffic flow should be like that. And this flow is not manageable in a long time. 

[hbuenafe81]

Thank you ozkanaltas, appreciated much and I understand you, however I have multiple clients and connection using L3 MPLS setup which configure in routers. I'm not sure why server drop the request, unless i will NAT it on fortigate. Its like double natting happen.  Note other client is working except this s2s.