site to site vpn tunnel is up but no traffic flowing

[fortinoy]

setup site to site vpn using the ipsec wizard. tunnel is already up but keeps on getting the error "progress ipsec phase 1 negotiate failure" in vpn events log. need your help where and what to check.

note: i initially setup ssl vpn on the same fortigate and it works well. trying to setup the site to site vpn now. the setup on the ipsec wizard is easy and fast. but it is not working.

please advise. thanks.

[ede_pfau]

Do you enable NAT-Traversal on both sides? NAT is used.

[rwpatterson]

Do you have a static route with a lower distance than the default defined pointing down the tunnel? This is needed on both ends.

[fortinoy]

Yes NAT traversal is enabled on both Fortinet

[fortinoy]

The administrative distance of the static route for the tunnel is 10. We have a static route with a lower administrative distance than the tunnel at both ends.

[fortinoy]

I changed the phase 2 proposal to AES 128, SHA 1 and 43200 lifeseconds on both Fortinet. Nothing happens. Tunnel is still up but can't ping devices on LAN. Can only ping the public IP of the wan interface on both Fortinet. Really frustrating.

[zaphod]

Hi,

just to be sure... do you have policies which allow the traffic through the vpn-tunnel?

which networks are defined in the phase 2 to speak with each other? 

with forti to forti you can define 0.0.0.0 (any) so you can control which traffic with policies only... 

zaphod

[fortinoy]

yes two policies were setup. from local LAN subnet to tunnel, from tunnel to local LAN subnet. this is setup on the other fortinet too. the static route's destination is the remote local LAN subnet and the source interface is the tunnel with an administrative distance of 10. a static route to the internet with administrative distance of 1 is also setup.

[fortinoy]

the route to the internet is 0.0.0.0/0 via sd wan which has an administrative distance of 1. the route of the tunnel is remote LAN subnet via tunnel interface with an administrative distance of 10. so should we put a 1 on the route to the tunnel and 10 on the route to the internet?

[zaphod]

ahhh you use sdwan... important information for support..

look at this and compare your config

https://kb.fortinet.com/kb/documentLink.do?externalID=FD41297

greets

zaphod

[rwpatterson]

fortinoy wrote:

the route to the internet is 0.0.0.0/0 via sd wan which has an administrative distance of 1. the route of the tunnel is remote LAN subnet via tunnel interface with an administrative distance of 10. so should we put a 1 on the route to the tunnel and 10 on the route to the internet?

The default gateway is the the gateway of last resort. If the distance is 1, then no traffic will ever go anywhere else. Make that distance greater than the distance of any other location you wish to reach or that traffic will simply go out the default gateway and get dropped at the ISP.