IP Sec Site to Site VPN is connected but no Data Transfer

[gohar_aziz_it]

Hi Good Afternoon everyone,

I created a Site to Site IP Sec VPN between HQ and Branch and its showing its Connected and the IP are correct as well but there is no Data Transfer.

I created the Same Setup HQ2 to Branch and thats working.

HQ to Branch is pinging in CLI

Branch to HQ is not Pinging in CLI and in Log its giving this error.

Log Details from Branch

General

Date06/28/2017Time12:21:34Virtual DomainrootLog DescriptionIPsec phase 1 errorSourceLocal IPX.X.X.XUserN/AGroupN/AXAUTH UserN/AXAUTH GroupN/AActionActionnegotiateStatusnegotiate_errorReasonpeer notification

Security

Level EventAssigned IPN/ACookies334564e550384b37/d28e4abcdfa61320Local Port500Outgoing Interfaceppp1Remote IP83.110.14.120Remote Port500VPN TunnelSHJ-2-DSOMessageIPsec phase 1 error

[rwpatterson]

Welcome to the forums.

Please check the routing table. There should be routes (if the tunnels are in interface mode). Also policies need to be made on each side in each direction. This way traffic originating from each end will be allowed through.

Hope that helps.

[gohar_aziz_it]

I create the Static Routes and Policies Internal to VPN profile and VPN profile to Internal without NAT.

But Still Not working.

[gohar_aziz_it]

Please find the Google Drive Link for Screenshots of all the configurations I have on HQ(DSO) and Branch(SHJ)

https://drive.google.com/...GhxLWlPeXM?usp=sharing

[rwpatterson]

On the remote end, check the distance on the static route. The end that's not working may have a static route the same distance as the default, and the FGT may be trying to route the traffic out the default gateway. There should be a setting in the GUI to allow you to see the distance. That version of code is newer than what I am accustomed to. If not, just pull up the "router > static route" config from the CLI and adjust it there.

[gohar_aziz_it]

There is another Tunnel with the Same Configuration as this and that is working fine.

Following is the Static Route Configuration.

[rwpatterson]

What is the "Administrative Distance" of your default gateway? If it is 10, then lower this one, or just keep looking elsewhere. The other one may be working simply because the FGT chose it over the default by coincidence (or design). Just because something works, doesn't necessarily mean it is correct. Do the leg work.