Hot!VPN Ipsec is up but can’t ping

Page: 12 > Showing page 1 of 2
Author
sindbad
New Member
  • Total Posts : 14
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/08/31 15:50:48
  • Status: offline
2018/08/31 16:07:47 (permalink)
0

VPN Ipsec is up but can’t ping

I have a fortigate on v6. I have setup ipsec vpn. It’s connected to a sophos xg firewall.

The vpn is showing up. I can’t ping. I have on both firewalls the policy enabled for vpn to lan and lan to vpn.

I have static route added on fortigate.

I see incoming log but outgoing log is 0.

I hope someone can help me.
#1

22 Replies Related Threads

    Ashu
    Gold Member
    • Total Posts : 141
    • Scores: 12
    • Reward points: 0
    • Joined: 2015/04/17 04:33:45
    • Location: Muscat,Oman
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 03:53:11 (permalink)
    0
    Hi,
    VPN tunnel Up means Phase 1 is fine .You just match your phase2 configuration ,routing and security policy at both side .
     
    Regds,
     
    Ashik
    #2
    sindbad
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/31 15:50:48
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 04:21:27 (permalink)
    0
    Well I have the phase 2 configured correctly. Sophos support had a remote look and said it’s all good. The issue lies with the fortigate firewall. You know how it goes, one vendor points to the other vendor.

    Hope someone can tell me how to check if it’s really about phase2.
    #3
    sindbad
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/31 15:50:48
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 04:44:07 (permalink)
    0
    I just checked on both sides. Changed the phase2. There is no connection anymore. Can’t get the vpn up
    It tells me that the problem is not the phase2.

    I have my firewall open for vpn. Lan to vpn. Vpn to lan.
    Also the routing is added.

    Still not a clue where it’s going wrong.

    I am looking for help on the forum section because in my opinion there are a lot of clever people here.
    I have support on the fg firewall. I can call for remote support. But i have seen them not doing a great job.
    #4
    Ashu
    Gold Member
    • Total Posts : 141
    • Scores: 12
    • Reward points: 0
    • Joined: 2015/04/17 04:33:45
    • Location: Muscat,Oman
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 07:40:16 (permalink)
    0
    Hi ,
     
    Ok, kindly share fortigate Vpn configuration as well as sophos vpn parameter , let see what went wrong .
     
    Regds,
     
    Ashik
    #5
    ede_pfau
    Expert Member
    • Total Posts : 5721
    • Scores: 387
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 07:40:24 (permalink)
    0
    I've experienced Support doing a superb job. More than once.
    If you expect help on the forum then please post the relevant parts of the config:
    vpn ip phase1-interface
    vpn ip phase2-interface
    firewall policy
    route static

    from the CLI.
    You also can debug a bit and post the output:
    diag debug enable
    di de app ike -1

     
    (to stop scrolling, 'di de di'; to reset: 'di de app ike 0')
     
    And always ping from hosts behind the firewalls, not from the FGT's CLI. Check that the host's software firewall is OFF.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #6
    sindbad
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/31 15:50:48
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 07:57:36 (permalink)
    0
    Here you go:

    config vpn ipsec phase1-interface
    edit "VPN"
    set interface "wan1"
    set peertype any
    set proposal aes128-sha256
    set dhgrp 14
    set nattraversal disable
    set remote-gw 217.100.11.164
    set psksecret ENC 09KfjeK/J3wwarSADlgYszJKZzY5yMlmE9HhBqmp8i1xtFvIMI2gqbgfncSGzlSU93mAxrYY6X280QIaylrKcJOuPhyFJQasTtCi7+fa7KMH07C2vOhrAZj/R3CeDBoSEISYqzO53h2R0S/s8624WqAkF/bhDyKrjc0EUkuvlpTWrWfPwjhT6KyItsSJO9h4WxL40w==


    config vpn ipsec phase2-interface
    set phase1name "VPN"
    set proposal aes128-sha256
    set dhgrp 14
    set src-subnet 10.24.5.0 255.255.255.0
    set dst-subnet 192.168.104.0 255.255.255.0

    config firewall policy
    edit 37
    set name "ipsec to local"
    set uuid d5f533ee-ad5c-51e8-902e-c8570788bc6f
    set srcintf "VPN"
    set dstintf "wan1"
    set srcaddr "all"
    set dstaddr "all"
    set action accept
    set status enable
    set schedule "always"
    set service "ALL"
    next
    edit 38
    set name "local to ipsec"
    set uuid 1d570582-ad5d-51e8-ca02-e79f8ef5b6cc
    set srcintf "wan1"
    set dstintf "VPN"
    set srcaddr "all"
    set dstaddr "all"
    set action accept
    set status enable
    set schedule "always"
    set service "ALL"


    config router static
    edit 1
    set gateway 176.74.240.62
    set device "wan1"
    next
    edit 3
    set dst 192.168.3.0 255.255.255.0
    set device "p1-fw-var"
    next
    edit 4
    set dst 192.168.2.0 255.255.255.0
    set device "p1-fw-var"
    next
    edit 5
    set dst 192.168.0.0 255.255.252.0
    set device "OUT"
    next
    edit 6
    set gateway 176.74.234.54
    set distance 20
    set priority 1
    set device "wan1"
    next
    edit 8
    set dst 192.168.104.0 255.255.255.0
    set device "VPN"
    next

    post edited by Sind123# - 2018/09/01 08:27:17
    #7
    sindbad
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/31 15:50:48
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 08:00:27 (permalink)
    0
    When I go to the ipsec monitor:

    Incoming data is showing 2mb.
    Outgoing data 0b.
    #8
    Ashu
    Gold Member
    • Total Posts : 141
    • Scores: 12
    • Reward points: 0
    • Joined: 2015/04/17 04:33:45
    • Location: Muscat,Oman
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 10:14:44 (permalink)
    5 (2)
    Hi 
     
    I checked your conf ...VPN conf looks fine but Policy is incorrect .Instead of LAN interface policy shows "Wan1" which is your VPN gateway interface .
     
    config firewall policy
    edit 37
    set name "ipsec to local"
    set uuid d5f533ee-ad5c-51e8-902e-c8570788bc6f
    set srcintf "VPN"
    set dstintf "wan1"  (This interface should be LAN Interface where your local subnet is )
    set srcaddr "all"
    set dstaddr "all"
    set action accept
    set status enable
    set schedule "always"
    set service "ALL"
    next
    edit 38
    set name "local to ipsec"
    set uuid 1d570582-ad5d-51e8-ca02-e79f8ef5b6cc
    set srcintf "wan1" (This interface should be LAN Interface where your local subnet is )
    set dstintf "VPN"
    set srcaddr "all"
    set dstaddr "all"
    set action accept
    set status enable
    set schedule "always"
    set service "ALL"
    #9
    sindbad
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/31 15:50:48
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 11:19:52 (permalink)
    0
    I changed it. Thanks a lot. I can make a connection now. Only one more thing.
     
    I can ping from sophos lan to fortigate lan.
    I can't ping from fortigate to the sophos client lan.
     
    Is this another setting?
    #10
    Ashu
    Gold Member
    • Total Posts : 141
    • Scores: 12
    • Reward points: 0
    • Joined: 2015/04/17 04:33:45
    • Location: Muscat,Oman
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 11:24:36 (permalink)
    0
    Hi,
     
    By default you can't ping from fortigate to VPN site LAN.To ping from fortigate you should do source ping ..like eg
     
    #exe Ping-option source {your LAN interface IP}
    #exe Ping {destination VPN LAN IP}
     
    Now you should be able to ping 
     
    Regds,
     
    Ashik,NSE8
    #11
    sindbad
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/31 15:50:48
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 11:30:14 (permalink)
    0
    1) I have a windows client on the fortigate side. I would like to ping to a windows system on the sophos client.
    This is not possible?
     
    2) I have to execute the command through the cli you mean?
    #12
    Ashu
    Gold Member
    • Total Posts : 141
    • Scores: 12
    • Reward points: 0
    • Joined: 2015/04/17 04:33:45
    • Location: Muscat,Oman
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 11:33:15 (permalink)
    0
    Behind LAN interface systems can ping other side if your conf is fine.But from fortigate you should do source ping which i posted earlier .
     
    Regds,
     
    Ashik
    #13
    sindbad
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/31 15:50:48
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 11:39:39 (permalink)
    0
    Got it.
    Unfortanetly I can't ping from the FG clients to the Sophos clients. Sophos clients to FG clients is working fine.
    I do have a VPN connection. So I can remote from Sophos clients to the FG clients.
     
    What do you need from my end, so you can help me out. Thanks a lot for your help. Almost there!!
    #14
    Ashu
    Gold Member
    • Total Posts : 141
    • Scores: 12
    • Reward points: 0
    • Joined: 2015/04/17 04:33:45
    • Location: Muscat,Oman
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 11:43:18 (permalink)
    5 (1)
    Hi,
     
    Get me your LAN interface IP or Conf and also let me know Which IP u want to ping .
     
    I can give you exact cmd..
     
    Regds,
    Ashik
    #15
    sindbad
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/31 15:50:48
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 11:47:54 (permalink)
    0
    LAN IP: 192.168.104.0 (sophos)
    Want to ping the machine: 192.168.104.22 (machine is ofcourse online).
    #16
    sindbad
    New Member
    • Total Posts : 14
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/31 15:50:48
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/01 12:15:08 (permalink)
    3 (2)
    @Ashik helped me through a remote session. Changed a policy and now I can ping from FG LAN to Sophos LAN.
     
    All working and thanks to @Ashik!
    #17
    SirichaiJi
    New Member
    • Total Posts : 10
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/09/04 01:06:15
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/04 01:28:49 (permalink)
    0
    Ashik, Thank i got problem like this. Its done!
    How can send log to NAS (Qnap) to other site by vpn ? One thing you have to know I got 2 FG device each HQ and Brand site but only one nas device (192.168.10.26) then HQ is using that and yes log has been recorded to nas. then i want Brand site send log to nas as well by vpn site to site  (192.168.10.26). Please help thank
     
     
    New for Foritgate 
    My English skill so weak 
    #18
    SirichaiJi
    New Member
    • Total Posts : 10
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/09/04 01:06:15
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/04 01:32:18 (permalink)
    0
    Opss! I test close webUI after i open webUi i tested FG-Brand ping to client's HQ can not ping. How can make ping all time (send log)
    #19
    Ashu
    Gold Member
    • Total Posts : 141
    • Scores: 12
    • Reward points: 0
    • Joined: 2015/04/17 04:33:45
    • Location: Muscat,Oman
    • Status: offline
    Re: VPN Ipsec is up but can’t ping 2018/09/04 02:45:26 (permalink)
    0
    Hi
     
    Try pinging from client behind FG , from Fg u can't ping directly .
     
    Give me more details on NAS what do u want ti record and from where do u want to record.
     
    regds,
     
    ashik
    #20
    Page: 12 > Showing page 1 of 2
    Jump to:
    © 2018 APG vNext Commercial Version 5.5