vpn ipsec working but only inbound

[fferraro87]

Hi,

i've set a vpn ipsec tunnel from my fg 100D to a huawei firewall. I've set an ipsec (interface mode) and it works, tunnel it's working. But if i try to ping from my side to remote side i've only an icmp request from me but not a reply from remote side. Insetad if from remote side ping an ip on my side i see your icmp request and my reply but from remote side they don't see my reply. So i think that something it's wrong inside the tunnel or on my tunnel gateway.

that's a strange thing because if i sniff packet on the tunnel interface and every packet go inside tunnel so i don't know where packet it's stopped.

that's my ipsec configuration :

PHASE 1
config vpn ipsec phase1-interface
    edit "Frankfurt"
        set interface "VLAN 306"
        set peertype any
        set proposal aes256-sha256
        set dhgrp 2
        set remote-gw 185.96.220.1
        set psksecret ENC RYIFiKA46Wuk4Tf9xOA/7Dx0ZVWUt3UZsUpIpMiTSmewUZoHl4Ip2xSdB/FziWOAWD5bAEg6ryRcfoKJLBhgLahdr60kuRsXjFM4rekVkyNglU/oqCwdn/AmJLmlVnxRZ4XseGQt96nKugLTSbPwFqyiov0VJ1FhtZTzg==
    next
end
PHASE 2
config vpn ipsec phase2-interface
    edit "Frankfurt"
        set phase1name "Frankfurt"
        set proposal aes256-sha256
        set dhgrp 2
        set auto-negotiate enable
        set keylifeseconds 3600
        set src-subnet 192.168.2.0 255.255.255.0
        set dst-subnet 10.23.1.0 255.255.255.0
    next
end
STATIC ROUTE

edit 6
    set gateway 185.96.220.1
    set device "VLAN 306"
next

edit 10
    set dst 10.23.1.0 255.255.255.0
    set device "Frankfurt"
next

POLICY

config firewall policy
    edit 113
        set name "vpon Frankfurt to FrankDC"
        set uuid 8924d576-a549-51e8-c39c-ba9e4b33a75e
        set srcintf "Frankfurt"
        set dstintf "FrankDC"
        set srcaddr "lan Frankfurt"
        set dstaddr "lan-FrankDC"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end

config firewall policy
    edit 112
        set name "vpn FrankDC to Frankfurt"
        set uuid 76f2a220-a549-51e8-bb79-67305b7e96ab
        set srcintf "FrankDC"
        set dstintf "Frankfurt"
        set srcaddr "lan-FrankDC"
        set dstaddr "lan Frankfurt"
        set action accept
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set logtraffic all
    next
end

and that's sniffing log like i said before :

FROM FRANKFURT TO ME
interfaces=[Frankfurt]
filters=[none]
pcap_lookupnet: Frankfurt: no IPv4 address assigned
12.793932 10.23.1.136 -> 192.168.2.94: icmp: echo request
12.794324 192.168.2.94 -> 10.23.1.136: icmp: echo reply
17.333923 10.23.1.136 -> 192.168.2.94: icmp: echo request
17.334292 192.168.2.94 -> 10.23.1.136: icmp: echo reply
FROM ME TO FRANKFURT

interfaces=[Frankfurt]
filters=[none]
pcap_lookupnet: Frankfurt: no IPv4 address assigned
2.117339 192.168.2.47 -> 10.23.1.116: icmp: echo request
6.999698 192.168.2.47 -> 10.23.1.116: icmp: echo request
11.999278 192.168.2.47 -> 10.23.1.116: icmp: echo request
17.000813 192.168.2.47 -> 10.23.1.116: icmp: echo request
22.001448 192.168.2.47 -> 10.23.1.116: icmp: echo request
33.432047 192.168.2.47 -> 10.23.1.116: icmp: echo request

12 packets received by filter
0 packets dropped by kernel


SA
list ipsec tunnel by names in vd 0
------------------------------------------------------
name=Frankfurt ver=1 serial=6 185.96.220.2:0->185.96.220.1:0
bound_if=34 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/0
proxyid_num=1 child_num=0 refcnt=21 ilast=10 olast=4 auto-discovery=0
stat: rxp=146 txp=407 rxb=18200 txb=24750
dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=76
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=Frankfurt proto=0 sa=1 ref=2 serial=7 auto-negotiate
  src: 0:192.168.2.0/255.255.255.0:0
  dst: 0:10.23.1.0/255.255.255.0:0
  SA: ref=3 options=822f type=00 soft=0 mtu=1438 expire=1290/0B replaywin=2048 seqno=198 esn=0 replaywin_lastseq=00000092
  life: type=01 bytes=0/0 timeout=3576/3600
  dec: spi=566250a4 esp=aes key=32 14fd44171109e6f4c5a8e8b2dcc2b0465332875797ac258afeac9ef9b42f679f
       ah=sha256 key=32 69b1a44625c4448fb689e4c618afe95f98f94cac7d8c7f88492379c3c1c94c89
  enc: spi=b7fa96fb esp=aes key=32 90db3d6abf14d71ecf5c2e11c1a82dce2dd22d203ec592ec2b85b440953d8f1b
       ah=sha256 key=32 5507ab5aacf2fa50d0f20d9e98a5d7b7a4446d818b438830c897bb9029c56251
  dec:pkts/bytes=146/8868, enc:pkts/bytes=407/50804
 
FG100D3G16809351 # diagnose vpn tunnel list name Frankfurt
list ipsec tunnel by names in vd 0
------------------------------------------------------
name=Frankfurt ver=1 serial=6 185.96.220.2:0->185.96.220.1:0
bound_if=34 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/0
proxyid_num=1 child_num=0 refcnt=21 ilast=14 olast=3 auto-discovery=0
stat: rxp=146 txp=408 rxb=18200 txb=24810
dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=76
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=Frankfurt proto=0 sa=1 ref=2 serial=7 auto-negotiate
  src: 0:192.168.2.0/255.255.255.0:0
  dst: 0:10.23.1.0/255.255.255.0:0
  SA: ref=3 options=822f type=00 soft=0 mtu=1438 expire=1286/0B replaywin=2048 seqno=199 esn=0 replaywin_lastseq=00000092
  life: type=01 bytes=0/0 timeout=3576/3600
  dec: spi=566250a4 esp=aes key=32 14fd44171109e6f4c5a8e8b2dcc2b0465332875797ac258afeac9ef9b42f679f
       ah=sha256 key=32 69b1a44625c4448fb689e4c618afe95f98f94cac7d8c7f88492379c3c1c94c89
  enc: spi=b7fa96fb esp=aes key=32 90db3d6abf14d71ecf5c2e11c1a82dce2dd22d203ec592ec2b85b440953d8f1b
       ah=sha256 key=32 5507ab5aacf2fa50d0f20d9e98a5d7b7a4446d818b438830c897bb9029c56251
  dec:pkts/bytes=146/8868, enc:pkts/bytes=408/50928

the only "strange" thing that i've see that the remote gateway of this vpn tunnel it's same gateway for my outgoing interface (VLAN 306).

Maybe this is the problem? Thanks

[ede_pfau]

I've noticed the strange routes as well.

In words:

- the default route (to the internet) is pointing to VLAN306

(might be, maybe VLAN306 is a subinterface of wan1)

- the next hop gateway is the public IP of the other site you are trying to reach via VPN

(sounds wrong; if you send unencrypted traffic to this gw, why build a tunnel anyway?)

- the network behind the tunnel is reachable through the tunnel interface

(correct)

So, I would look at the default route, and where your real gateway to the internet is.

[fferraro87]

ede_pfau wrote:

I've noticed the strange routes as well.

In words:

- the default route (to the internet) is pointing to VLAN306

(might be, maybe VLAN306 is a subinterface of wan1)

- the next hop gateway is the public IP of the other site you are trying to reach via VPN

(sounds wrong; if you send unencrypted traffic to this gw, why build a tunnel anyway?)

- the network behind the tunnel is reachable through the tunnel interface

(correct)

So, I would look at the default route, and where your real gateway to the internet is.

yeah VLAN306 is a subinterface of wan1 and yes the next hop gateway is the remote gateway of that tunnel , i need to build a tunnel because over my fortigate there is that my ISP that has that huawei firewall and i need to connect to a local subnet of that ISP and they want to create that tunnel in order to do that.

Yeah i know it's a strange things, but it's not depends to me. I try to change priority of 6 and 10 static route in order to prioritize route inside tunnel but i've always same situation.