AnsweredHot!IPSEC tunnel traffic issue

Author
JoSy
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/07/24 02:38:45
  • Status: offline
2018/07/24 02:54:47 (permalink)
0

IPSEC tunnel traffic issue

Situation:
We have a site2multi-site situation. The main site A 10.10.0.x and secundary site B 10.10.16.x .
Printer 10.10.16.230 directly connected to the firewall.
Site2site with IPSEC vpn tunnel
 
Policy:
Site A -> Site B allow any
Site B -> Site A allow any
No antivirus or anything enabled
 
Problem:
When we try to surf to a printer or switch webconfig page from A -> B the browser shows http://10.10.16.230/index.html  but it keeps loading. @Site B we can browse perfectly fine to the webconfig.
 
Noticed:
- Ping works in both ways
- RDP works from B-> A if we disable IPV4-Offload (NIC computer)
- DNS server @site A, so the client computers @siteB can surf without any issue through dns server(A)
- Other sites are not having this issue
- The printer cannot send mail from site B -> Mailserver Site A
 
Already tried:
- Remove ipsec tunnel and created a new one
- rebooted firewall @siteB
- disabled/enabled auto-asic on all policy's (A + B)
 
Does anyone have a clue what this could be? We dont know where to look
#1
emnoc
Expert Member
  • Total Posts : 4942
  • Scores: 306
  • Reward points: 0
  • Joined: 2008/03/20 13:30:33
  • Location: AUSTIN TX AREA
  • Status: offline
Re: IPSEC tunnel traffic issue 2018/07/24 06:06:40 (permalink)
0
The cl-cmd diag debug flow  is your best friend but it sounds like it's not the firewall. I would ensure the  proper network mask and gateway on the printer.
 
 
Ken

PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
#2
Toshi Esumi
Expert Member
  • Total Posts : 1050
  • Scores: 66
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: IPSEC tunnel traffic issue 2018/07/24 08:48:40 (permalink) ☼ Best Answerby JOJO SYSTEMS 2018/07/26 07:24:27
5 (2)
I took your statement,
"- Other sites are not having this issue"
as other sites have similar printers and accessing it from site A doesn't show problems, nor printer's email server access at site A.
I would verify no MTU issues inbetween A and B by pinging FGT-to-FGT outside the tunnel and inside with more than 1500bytes packets. Then run flow debug as emnoc suggested.
#3
JoSy
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/07/24 02:38:45
  • Status: offline
Re: IPSEC tunnel traffic issue 2018/07/26 07:23:11 (permalink)
0
The MTU was the problem! After lowering it, the problem was solved!
#4
Jump to:
© 2018 APG vNext Commercial Version 5.5