site to site vpn tunnel up but no other traffic

[MISLuke]

I have configured a site2site vpn for my fortigate devices main office: fgt200B on 4.0MR1 patch 5 (internal lan:.104.x/22) remote office: fgt80C on 4.0MR1 patch 2 (internal lan: .1.x/24) I configured them in route-based. FGT200B configuration 1) fgt200B->router->static route, Des ip: .1.x/24 device is virtual vpn interface. 2) create a policy route in fgt200b->router->policy route, if internal source .104.x/22-> destination .1.x/24, force traffic to virtual vpn interface, gateway 0.0.0.0. 3) Firewall policy: internal->virtual vpn interface, traffic all to all; virtual vpn interface->internal, traffic all to all 4) in phase 2 of site2site vpn, the source is .104.0/22 dest is .1.0/24 FGT80C configuration 1) fgt80C->router->static route, Des ip: .104.x/22, device is virtual vpn interface. 2) create a policy route in fgt80C->router->policy route, if internal source .1.x/24-> destination .104.x/22, force traffic to virtual vpn interface, gateway 0.0.0.0. 3) Firewall policy: internal->virtual vpn interface, traffic all to all; virtual vpn interface->internal, traffic all to all 4) in phase 2 of site2site vpn, the source is .1.0/24 dest is .104.0/22 Tunnel is up as i can see on the vpn->ipsec->monitor. But when i attempt to ping from internal lan to remote lan, timeout. So what i miss out?

[ede_pfau]

Hi, why would you use a policy route if a static regular route suffices? Policy routes take precedence over regular routing, bypassing the routing table altogether. If you take the tunnel interface just as an additional port and setup everything like you would with a simple physical port it should work: - one difference: tunnel interfaces do not need interface IPs - you need a route to the port/subnet - you need a policy internal->port - for sessions initiated at the remote site, you need a policy port->internal Same applies for the remote site. So I see that on the FG80C you only use policy routing. Give it a static route to the main subnet, eliminate the PR on the main FG and test again.

[MISLuke]

Hi, I remove the policy route from both fgts. still unable to ping to either site. tunnel is still up. there are 2 firewall policy at each fgt, one is internal->vpn interface, the other is vpn interface->internal. both polices at both fgts are set all to all.

[ede_pfau]

what about the missing static route on the FG80C?

[MISLuke]

Hi, I added the static route in the remote office fgt. dest .104.0/22 device virtual vpn interface

[ede_pfau]

...and?? In case you can' t ping even now: - try to ping the internal interface IP of the opposite FG. You have to enable PING for each internal interface in Network>Interface beforehand. - you are absolutely sure that the tunnel is UP? Monitor+event log, both sides? - you haven' t put anything other than ANY into the service field of the policies, have you?

[rwpatterson]

This policy should be from local->remote subnet on each side and should appear at the top of the policy lists (before other ' accept' policies).