One way pings over VPN

[krusty]

Hi,

I am seeing an issue with an IPSEC VPN where I can only ping from one side. The other side simply drops the packets.

Ran a debug flow and found the following:

id=20085 trace_id=100 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=1, 10.0.0.2:8448->192.168.0.1:8) from vpn.UK-NTHM. code=8, type=0, id=8448, seq=1024." id=20085 trace_id=100 func=init_ip_session_common line=4569 msg="allocate a new session-0355580a" id=20085 trace_id=100 func=ip_route_input_slow line=1273 msg="reverse path check fail, drop" id=20085 trace_id=100 func=ip_session_handle_no_dst line=4636 msg="trace"

This device connects via a fibre router and picks up its public ip address via DHCP

edit "UFB"

        set vdom "root"

        set mode dhcp

        set allowaccess https ssh

        set snmp-index 19

        set interface "wan1"

        set vlanid 10

The problem seems to be that the 10.0.0.2 is not in the routing table and the packets are therefore being dropped "reverse path check fail, drop". The default route is the public ip address not the 10.0.0.2 address.

What is the best way to resolve this issue?

Thanks

id=20085 trace_id=100 func=print_pkt_detail line=4420 msg="vd-root received a packet(proto=1, 10.0.0.2:8448->192.168.0.1:8) from vpn.UK-NTHM. code=8, type=0, id=8448, seq=1024."id=20085 trace_id=100 func=init_ip_session_common line=4569 msg="allocate a new session-0355580a"id=20085 trace_id=100 func=ip_route_input_slow line=1273 msg="reverse path check fail, drop"id=20085 trace_id=100 func=ip_session_handle_no_dst line=4636 msg="trace"

[ede_pfau]

Well, the FGT does what it is supposed to do - protect you from traffic from an unknown subnet.

Make the 10.x subnet known to the FGT and all will be fine.

Create a static route for the subnet 10.0.0.0/24 or even 10.0.0.2/30, pointing to the next router's interface IP.

(Although you were on the right track, and the error message clearly states a problem with the subnet address, you did not supply any address information of your setup.)