strange behavior on IPSEC Tunnel - Fortigate v7.0.9 - Evaluation License - GNS3

[JuniorSilvaX93]

Hello dear,

I'm experiencing strange behavior on the FortiGate # with OS Evaluation License.

The laboratory was set up to simulate the following scenario.

C<->A<->B

"Point A" is a central node

So all the settings were made, they worked normally.

But apparently something causes the "point B" IPSEC tunnels to stop working from point A to point C.

After a reboot of the Point A Fortigate, everything works normally

if I Enter in DEBUG mode of Point A, it me shows this log:

FORTI1 # id=20085 trace_id=101 func=print_pkt_detail line=5845 msg="vd-root:0 received a packet(proto=1, 192.168.3.2:28988->192.168.2.1:2048) tun_id=192.168.15.180 fro
m A_PARA_C. type=8, code=0, id=28988, seq=26."
id=20085 trace_id=101 func=init_ip_session_common line=6024 msg="allocate a new session-00000dea, tun_id=192.168.15.180"
id=20085 trace_id=101 func=vf_ip_route_input_common line=2605 msg="find a route: flag=00000000 gw-192.168.15.150 via LADO-A"
id=20085 trace_id=102 func=print_pkt_detail line=5845 msg="vd-root:0 received a packet(proto=1, 192.168.3.2:28988->192.168.2.1:2048) tun_id=192.168.15.180 from A_PARA_
C. type=8, code=0, id=28988, seq=27."
id=20085 trace_id=102 func=init_ip_session_common line=6024 msg="allocate a new session-00000dec, tun_id=192.168.15.180"
id=20085 trace_id=102 func=vf_ip_route_input_common line=2605 msg="find a route: flag=00000000 gw-192.168.15.150 via LADO-A"
id=20085 trace_id=103 func=print_pkt_detail line=5845 msg="vd-root:0 received a packet(proto=1, 192.168.3.2:28988->192.168.2.1:2048) tun_id=192.168.15.180 from A_PARA_
C. type=8, code=0, id=28988, seq=28."
id=20085 trace_id=103 func=init_ip_session_common line=6024 msg="allocate a new session-00000def, tun_id=192.168.15.180"
id=20085 trace_id=103 func=vf_ip_route_input_common line=2605 msg="find a route: flag=00000000 gw-192.168.15.150 via LADO-A"
id=20085 trace_id=104 func=print_pkt_detail line=5845 msg="vd-root:0 received a packet(proto=1, 192.168.3.2:28988->192.168.2.1:2048) tun_id=192.168.15.180 from A_PARA_
C. type=8, code=0, id=28988, seq=29."

Detailing the tests:
Point A
LAN 192.168.1.1/24

Point B
LAN 192.168.2.1/24

Point C
LAN 192.168.3.1/24

If from 192.168.3.2 I send ICMP req to 192.168.1.2, when problem occurrs, I won't received any response. After reboot
of Point A, I can PING again.

Can anyone help?

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[hbac]

Hi @JuniorSilvaX93,

So the issue is you can't ping from point C to point B? When the issue occurs, is the IPsec tunnel up or down? You also need to run debug flow on point B: 

di deb disable
di deb res
diagnose debug flow filter clear
di deb flow filter addr 192.168.2.1
di deb flow filter proto 1
diagnose debug flow show function-name enable
di deb flow show iprope en
diagnose debug console timestamp enable
diagnose debug flow trace start 500
diagnose debug enable

Regards,