Interface-VPN UP but doesn't ping

[joe72]

Hi all,

I'm new in this forum and also with Fortigate. I know very well screenOs.

I have to migrate some ScreenOs FW to Fortigate, and I've some problem with VPN.

At a moment I try to test a VPN Interface mode between two Fortigate. In my case I need to terminate a VPN to a secondary IP of FGT-B.

The tunnel goes UP, but when I tried to ping a PC on the other side on FGT-A the packet go throught the VPN, on FGT-B I get this error :

id=20085 trace_id=106 func=init_ip_session_common line=4522 msg="allocate a new session-00026962" id=20085 trace_id=106 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-2.0.2.70 via port3" id=20085 trace_id=106 func=fw_forward_handler line=545 msg="Denied by forward policy check (policy 0)"

The policy is present but I don't understand why this traffic don't match the policy.

The configuration of FGT-A is :

    edit "wan1"         set vdom "root"         set ip 192.168.10.1 255.255.255.0          set allowaccess ping fgfm auto-ipsec          set type physical          set snmp-index 2      next      edit "internal1"          set vdom "root"          set ip 3.3.3.1 255.255.255.0          set allowaccess ping          set type physical          set snmp-index 8      next config router static      edit 1          set dst 2.0.0.0 255.255.252.0          set device "vpn-interface"      next      edit 2          set dst 217.172.3.177 255.255.255.255          set gateway 192.168.10.46          set device "wan1"      next  end  config vpn ipsec phase1-interface      edit "vpn-interface"          set interface "wan1"          set remote-gw 217.172.3.177          set psksecret ENC IHRvb4gMgBk42WoYDg706BfnZbsRgAhjGJ9Er5NTmxFixdVkPpJMWSDm+X5vssgIL8JwK4gV4vfuoJBC6DJcU3/kZcvQiXCaT6/OarhSVm+oZAEL8EwQ/HxutZQusuL+4Iu+IPtJ7xhnGWfjNOVkrkyALGCmdcBMFBXmIdeRI/Lwz7Tr1YMR7Loilg/LCIopySRvvg==      next  end

config vpn ipsec phase2-interface     edit "vpn-interface"         set phase1name "vpn-interface"         set keepalive enable         set auto-negotiate enable         set src-subnet 3.3.3.0 255.255.255.0         set dst-subnet 2.0.0.0 255.255.252.0     next end  config firewall policy      edit 1          set uuid 9a3cebc8-a6d3-51e4-98c7-8833bac36c83          set srcintf "internal1"          set dstintf "vpn-interface"          set srcaddr "Local-3.3.3.0/24"          set dstaddr "Remote-2.0.0.0/22"          set action accept          set schedule "always"          set service "ALL"          set logtraffic all      next      edit 2          set uuid acf13a62-a6d3-51e4-0f03-cdac80dfdb8c          set srcintf "vpn-interface"          set dstintf "internal1"          set srcaddr "Remote-2.0.0.0/22"         set dstaddr "Local-3.3.3.0/24"          set action accept          set schedule "always"          set service "ALL"          set logtraffic all      next end

Configuration of FGT-B :

config system interface     edit "wan1"         set vdom "root"         set ip 192.168.10.46 255.255.255.0         set allowaccess ping fgfm auto-ipsec         set vlanforward enable         set type physical         set snmp-index 2         set secondary-IP enable             config secondaryip                 edit 1                     set ip 217.172.3.177 255.255.255.255                     set allowaccess ping                 next             end     next end config system interface     edit "port3"         set vdom "root"         set ip 2.0.3.233 255.255.252.0         set allowaccess ping https ssh http telnet         set vlanforward enable         set type physical         set snmp-index 22     next end config router static     edit 1         set dst 3.3.3.0 255.255.255.0         set device "Interface-vpn"     next end config vpn ipsec phase1-interface     edit "Interface-vpn"         set interface "wan1"         set local-gw 217.172.3.177         set localid "217.172.3.177"         set remote-gw 192.168.10.1         set psksecret ENC LCVkCt2hFmGE11lOy3K6u16DYU2pzT2U9bDMy2N+sobbdkUoeHbXKFv5DIUnh5a4qh7ihYVs2R6zwmtGDwf7Co8ZqdiU0H+VXtfajpHlElEFCow9Q1RwFzg4hUphn5KMkEDwn87vWYbIlX4BMBKmiwKgpL8qt+egqnJ3F+tx7ag5QlmW+5xlgKxBb3JH8R21VEaB2w==     next end config vpn ipsec phase2-interface     edit "Interface-vpn"         set phase1name "Interface-vpn"         set keepalive enable         set auto-negotiate enable         set src-subnet 2.0.0.0 255.255.252.0         set dst-subnet 3.3.3.0 255.255.255.0     next end config firewall policy     edit 2         set uuid 5496f3f6-a6d4-51e4-e9ba-c7a18745d9ce         set srcintf "Interface-vpn"         set dstintf "port3"         set srcaddr "Remote-3.3.3.0/24"         set dstaddr "Local-2.0.0.0/22"         set action accept         set schedule "always"         set service "ALL"         set logtraffic all     next     edit 1         set uuid 42daa2c0-a6d4-51e4-51f1-a9cda2b71e72         set srcintf "port3"         set dstintf "Interface-vpn"         set srcaddr "Local-2.0.0.0/22"         set dstaddr "Remote-3.3.3.0/24"         set action accept         set schedule "always"         set service "ALL"         set logtraffic all     next end

Someone can help me to understand where is the problem ?

Thanks in advance

Gionata

[rwpatterson]

Without digging too deeply into the configs, did you make sure that the static routes to the VPN remote endpoints had a shorter distance than the default? It doesn't appear so from what I read.

[jdambra · Accepted solution]

Hi!

I'm not sure if this could be your issue as well, but I recently upgraded the firmware of my 60D from 5.0 Patch7 Build # 3608 to 5.0.10 and then to the latest release 5.2.2 and, in that upgrade the custom service "ALL" erroneously changed its protocol number from "0" to "6" (i.e. from "ANY IP protocol" to just TCP). That change made the message:

msg="Denied by forward policy check (policy 0)"

To pop up in those policies using that custom service. Have you made a firmware upgrade on any one of your FWs? You could check if this is also happening to you executing:

show firewall service custom ALL

Through your FWs console.

[Shagma]

jdambra wrote:

Hi!

I'm not sure if this could be your issue as well, but I recently upgraded the firmware of my 60D from 5.0 Patch7 Build # 3608 to 5.0.10 and then to the latest release 5.2.2 and, in that upgrade the custom service "ALL" erroneously changed its protocol number from "0" to "6" (i.e. from "ANY IP protocol" to just TCP). That change made the message:

msg="Denied by forward policy check (policy 0)"

To pop up in those policies using that custom service. Have you made a firmware upgrade on any one of your FWs? You could check if this is also happening to you executing:

show firewall service custom ALL

Through your FWs console.

I just want to thank you for helping me solve this problem on one of my firewalls. I upgraded from 5.0.11 to 5.2.2 and found that the service ALL had been changed to protocol 6 instead of 0.

Damn you Fortinet.

[jdambra]

Yeah, I kind of lost like 4 hours of my life with this... I hope this post had helped you to loose a little less than that.

There is never a boring day working in IT...

[DJensen99]

jdambra wrote:

Hi!

I'm not sure if this could be your issue as well, but I recently upgraded the firmware of my 60D from 5.0 Patch7 Build # 3608 to 5.0.10 and then to the latest release 5.2.2 and, in that upgrade the custom service "ALL" erroneously changed its protocol number from "0" to "6" (i.e. from "ANY IP protocol" to just TCP). That change made the message:

msg="Denied by forward policy check (policy 0)"

To pop up in those policies using that custom service. Have you made a firmware upgrade on any one of your FWs? You could check if this is also happening to you executing:

show firewall service custom ALL

Through your FWs console.

I registered to say thank you for this.  I spun my wheels for 3 hours trying to figure out why ICMP and UDP were failing on a new install, but TCP worked fine, before I found this post.  Pretty major bug to let slip through the cracks...