sindbad
New Member
- Total Posts : 16
- Scores: 0
- Reward points: 0
- Joined: 2018/08/31 15:50:48
- Status: offline
VPN Ipsec is up but can’t ping
I have a fortigate on v6. I have setup ipsec vpn. It’s connected to a sophos xg firewall.
The vpn is showing up. I can’t ping. I have on both firewalls the policy enabled for vpn to lan and lan to vpn.
I have static route added on fortigate.
I see incoming log but outgoing log is 0.
I hope someone can help me.
|
Ashu
Gold Member
- Total Posts : 141
- Scores: 12
- Reward points: 0
- Joined: 2015/04/17 04:33:45
- Location: Muscat,Oman
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 03:53:11
(permalink)
Hi, VPN tunnel Up means Phase 1 is fine .You just match your phase2 configuration ,routing and security policy at both side . Regds, Ashik
|
sindbad
New Member
- Total Posts : 16
- Scores: 0
- Reward points: 0
- Joined: 2018/08/31 15:50:48
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 04:21:27
(permalink)
Well I have the phase 2 configured correctly. Sophos support had a remote look and said it’s all good. The issue lies with the fortigate firewall. You know how it goes, one vendor points to the other vendor.
Hope someone can tell me how to check if it’s really about phase2.
|
sindbad
New Member
- Total Posts : 16
- Scores: 0
- Reward points: 0
- Joined: 2018/08/31 15:50:48
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 04:44:07
(permalink)
I just checked on both sides. Changed the phase2. There is no connection anymore. Can’t get the vpn up It tells me that the problem is not the phase2.
I have my firewall open for vpn. Lan to vpn. Vpn to lan. Also the routing is added.
Still not a clue where it’s going wrong.
I am looking for help on the forum section because in my opinion there are a lot of clever people here. I have support on the fg firewall. I can call for remote support. But i have seen them not doing a great job.
|
Ashu
Gold Member
- Total Posts : 141
- Scores: 12
- Reward points: 0
- Joined: 2015/04/17 04:33:45
- Location: Muscat,Oman
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 07:40:16
(permalink)
Hi , Ok, kindly share fortigate Vpn configuration as well as sophos vpn parameter , let see what went wrong . Regds, Ashik
|
ede_pfau
Expert Member
- Total Posts : 5781
- Scores: 409
- Reward points: 0
- Joined: 2004/03/09 01:20:18
- Location: Heidelberg, Germany
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 07:40:24
(permalink)
I've experienced Support doing a superb job. More than once. If you expect help on the forum then please post the relevant parts of the config: vpn ip phase1-interface vpn ip phase2-interface firewall policy route static from the CLI. You also can debug a bit and post the output: diag debug enable di de app ike -1 (to stop scrolling, 'di de di'; to reset: 'di de app ike 0') And always ping from hosts behind the firewalls, not from the FGT's CLI. Check that the host's software firewall is OFF.
Ede " Kernel panic: Aiee, killing interrupt handler!"
|
sindbad
New Member
- Total Posts : 16
- Scores: 0
- Reward points: 0
- Joined: 2018/08/31 15:50:48
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 07:57:36
(permalink)
Here you go: config vpn ipsec phase1-interface edit "VPN" set interface "wan1" set peertype any set proposal aes128-sha256 set dhgrp 14 set nattraversal disable set remote-gw 217.100.11.164 set psksecret ENC 09KfjeK/J3wwarSADlgYszJKZzY5yMlmE9HhBqmp8i1xtFvIMI2gqbgfncSGzlSU93mAxrYY6X280QIaylrKcJOuPhyFJQasTtCi7+fa7KMH07C2vOhrAZj/R3CeDBoSEISYqzO53h2R0S/s8624WqAkF/bhDyKrjc0EUkuvlpTWrWfPwjhT6KyItsSJO9h4WxL40w==
config vpn ipsec phase2-interface set phase1name "VPN" set proposal aes128-sha256 set dhgrp 14 set src-subnet 10.24.5.0 255.255.255.0 set dst-subnet 192.168.104.0 255.255.255.0
config firewall policy edit 37 set name "ipsec to local" set uuid d5f533ee-ad5c-51e8-902e-c8570788bc6f set srcintf "VPN" set dstintf "wan1" set srcaddr "all" set dstaddr "all" set action accept set status enable set schedule "always" set service "ALL" next edit 38 set name "local to ipsec" set uuid 1d570582-ad5d-51e8-ca02-e79f8ef5b6cc set srcintf "wan1" set dstintf "VPN" set srcaddr "all" set dstaddr "all" set action accept set status enable set schedule "always" set service "ALL"
config router static edit 1 set gateway 176.74.240.62 set device "wan1" next edit 3 set dst 192.168.3.0 255.255.255.0 set device "p1-fw-var" next edit 4 set dst 192.168.2.0 255.255.255.0 set device "p1-fw-var" next edit 5 set dst 192.168.0.0 255.255.252.0 set device "OUT" next edit 6 set gateway 176.74.234.54 set distance 20 set priority 1 set device "wan1" next edit 8 set dst 192.168.104.0 255.255.255.0 set device "VPN" next
post edited by Sind123# - 2018/09/01 08:27:17
|
sindbad
New Member
- Total Posts : 16
- Scores: 0
- Reward points: 0
- Joined: 2018/08/31 15:50:48
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 08:00:27
(permalink)
When I go to the ipsec monitor:
Incoming data is showing 2mb. Outgoing data 0b.
|
Ashu
Gold Member
- Total Posts : 141
- Scores: 12
- Reward points: 0
- Joined: 2015/04/17 04:33:45
- Location: Muscat,Oman
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 10:14:44
(permalink)
Hi I checked your conf ...VPN conf looks fine but Policy is incorrect .Instead of LAN interface policy shows "Wan1" which is your VPN gateway interface . config firewall policy edit 37 set name "ipsec to local" set uuid d5f533ee-ad5c-51e8-902e-c8570788bc6f set srcintf "VPN" set dstintf "wan1" (This interface should be LAN Interface where your local subnet is ) set srcaddr "all" set dstaddr "all" set action accept set status enable set schedule "always" set service "ALL" next edit 38 set name "local to ipsec" set uuid 1d570582-ad5d-51e8-ca02-e79f8ef5b6cc set srcintf "wan1" (This interface should be LAN Interface where your local subnet is ) set dstintf "VPN" set srcaddr "all" set dstaddr "all" set action accept set status enable set schedule "always" set service "ALL"
|
sindbad
New Member
- Total Posts : 16
- Scores: 0
- Reward points: 0
- Joined: 2018/08/31 15:50:48
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 11:19:52
(permalink)
I changed it. Thanks a lot. I can make a connection now. Only one more thing. I can ping from sophos lan to fortigate lan. I can't ping from fortigate to the sophos client lan. Is this another setting?
|
Ashu
Gold Member
- Total Posts : 141
- Scores: 12
- Reward points: 0
- Joined: 2015/04/17 04:33:45
- Location: Muscat,Oman
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 11:24:36
(permalink)
Hi, By default you can't ping from fortigate to VPN site LAN.To ping from fortigate you should do source ping ..like eg #exe Ping-option source {your LAN interface IP} #exe Ping {destination VPN LAN IP} Now you should be able to ping Regds, Ashik,NSE8
|
sindbad
New Member
- Total Posts : 16
- Scores: 0
- Reward points: 0
- Joined: 2018/08/31 15:50:48
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 11:30:14
(permalink)
1) I have a windows client on the fortigate side. I would like to ping to a windows system on the sophos client. This is not possible? 2) I have to execute the command through the cli you mean?
|
Ashu
Gold Member
- Total Posts : 141
- Scores: 12
- Reward points: 0
- Joined: 2015/04/17 04:33:45
- Location: Muscat,Oman
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 11:33:15
(permalink)
Behind LAN interface systems can ping other side if your conf is fine.But from fortigate you should do source ping which i posted earlier . Regds, Ashik
|
sindbad
New Member
- Total Posts : 16
- Scores: 0
- Reward points: 0
- Joined: 2018/08/31 15:50:48
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 11:39:39
(permalink)
Got it. Unfortanetly I can't ping from the FG clients to the Sophos clients. Sophos clients to FG clients is working fine. I do have a VPN connection. So I can remote from Sophos clients to the FG clients. What do you need from my end, so you can help me out. Thanks a lot for your help. Almost there!!
|
Ashu
Gold Member
- Total Posts : 141
- Scores: 12
- Reward points: 0
- Joined: 2015/04/17 04:33:45
- Location: Muscat,Oman
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 11:43:18
(permalink)
Hi, Get me your LAN interface IP or Conf and also let me know Which IP u want to ping . I can give you exact cmd.. Regds, Ashik
|
sindbad
New Member
- Total Posts : 16
- Scores: 0
- Reward points: 0
- Joined: 2018/08/31 15:50:48
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 11:47:54
(permalink)
LAN IP: 192.168.104.0 (sophos) Want to ping the machine: 192.168.104.22 (machine is ofcourse online).
|
sindbad
New Member
- Total Posts : 16
- Scores: 0
- Reward points: 0
- Joined: 2018/08/31 15:50:48
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/01 12:15:08
(permalink)
@Ashik helped me through a remote session. Changed a policy and now I can ping from FG LAN to Sophos LAN. All working and thanks to @Ashik!
|
SirichaiJi
New Member
- Total Posts : 12
- Scores: 0
- Reward points: 0
- Joined: 2018/09/04 01:06:15
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/04 01:28:49
(permalink)
Ashik, Thank i got problem like this. Its done! How can send log to NAS (Qnap) to other site by vpn ? One thing you have to know I got 2 FG device each HQ and Brand site but only one nas device (192.168.10.26) then HQ is using that and yes log has been recorded to nas. then i want Brand site send log to nas as well by vpn site to site (192.168.10.26). Please help thank New for Foritgate My English skill so weak
|
SirichaiJi
New Member
- Total Posts : 12
- Scores: 0
- Reward points: 0
- Joined: 2018/09/04 01:06:15
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/04 01:32:18
(permalink)
Opss! I test close webUI after i open webUi i tested FG-Brand ping to client's HQ can not ping. How can make ping all time (send log)
|
Ashu
Gold Member
- Total Posts : 141
- Scores: 12
- Reward points: 0
- Joined: 2015/04/17 04:33:45
- Location: Muscat,Oman
- Status: offline
Re: VPN Ipsec is up but can’t ping
2018/09/04 02:45:26
(permalink)
Hi Try pinging from client behind FG , from Fg u can't ping directly . Give me more details on NAS what do u want ti record and from where do u want to record. regds, ashik
|