Hot!VPN site to site issues

Author
emerge
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/07/09 12:33:54
  • Status: offline
2019/07/09 12:42:32 (permalink)
0

VPN site to site issues

I'm pretty new to the Fortigate firewalls and trying to figure out where I'm possibly going wrong with the VPN site to site I have setup with another company. I am able to make a healthy connection between both sites and the vpn connection shows active but there is no traffic showing between them.  The other company says that they are unable to ping one of my servers but I can see their ping test through the ipsec monitor in the incoming data.  I am unable to ping their side from the server.  I went into the CLI of the fortigate and did an execute ping to 3 of their networks and was able to ping all 3 of the IPs.  So it seems like I am able to successfully ping through the firewall, but If I ping from a device on the network I cannot reach their end and vice versa.  Hopefully someone can point me in the right direction on what to check as I am completely unfamiliar with these particular brand of firewalls.
#1

4 Replies Related Threads

    hubertzw
    Gold Member
    • Total Posts : 193
    • Scores: 5
    • Reward points: 0
    • Joined: 2018/04/16 13:29:04
    • Status: offline
    Re: VPN site to site issues 2019/07/10 02:30:42 (permalink)
    0
    Can you show the output from the below command?
     
    diagnose sniffer packet any 'host X.X.X.X'
     
    1) when you ping the partner IPs
    2) when they try to ping your server
     
    When you can ping them from FGT it can be routing or policy issue. Can you show your selectors (IP or subnet)? Are you sure the source IP of the host in your network is within the range you set on the FGT as the source?
    #2
    emerge
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/07/09 12:33:54
    • Status: offline
    Re: VPN site to site issues 2019/07/10 06:50:16 (permalink)
    0
    Absolutely,
     
    1) When I ping their network
     
    TV-FW-60D # diag sniffer packet any "host 10.254.0.2"
    interfaces=[any]
    filters=[host 10.254.0.2]
     
    0 packets received by filter
    0 packets dropped by kernel
     
    2) On their end a week ago the tech did a tcmpdump and stated that he see's a udp encapsulated ipsec packet sent to our WAN address and can see his ping traversing the vpn connection but no response packet

    # tcpdump -nn net 172.21.1.0/24
    23:29:42.788605 IP 10.33.0.9 > 172.21.1.7: ICMP echo request, id 31588, seq 1, length 64
    23:30:03.973789 IP 10.33.0.9 > 172.21.1.7: ICMP echo request, id 31696, seq 1, length 64
    # tcpdump -nn 'net 50.254.200.220'
     
    23:29:42.788636 IP 10.33.252.205.4500 > 50.254.200.220.4500: UDP-encap: ESP(spi=0x170f4be0,seq=0xa), length 132
    23:29:49.307656 IP 10.33.252.205.4500 > 50.254.200.220.4500: NONESP-encap: isakmp: phase 2/others ? inf[E]
    23:29:49.329883 IP 50.254.200.220.4500 > 10.33.252.205.4500: NONESP-encap: isakmp: phase 2/others ? inf[E]
    23:29:57.450404 IP 10.33.252.205.4500 > 50.254.200.220.4500: isakmp-nat-keep-alive
    23:29:57.450550 IP 10.33.252.205.4500 > 50.254.200.220.4500: isakmp-nat-keep-alive
    23:29:57.450670 IP 10.33.252.205.4500 > 50.254.200.220.4500: isakmp-nat-keep-alive
    23:29:57.450830 IP 10.33.252.205.4500 > 50.254.200.220.4500: isakmp-nat-keep-alive
    23:29:57.451292 IP 10.33.252.205.4500 > 50.254.200.220.4500: isakmp-nat-keep-alive
    23:29:59.114239 IP 10.33.252.205.4500 > 50.254.200.220.4500: NONESP-encap: isakmp: phase 2/others ? inf[E]
    23:29:59.137438 IP 50.254.200.220.4500 > 10.33.252.205.4500: NONESP-encap: isakmp: phase 2/others ? inf[E]
    23:30:03.973823 IP 10.33.252.205.4500 > 50.254.200.220.4500: UDP-encap: ESP(spi=0x170f4be0,seq=0xb), length 132

    I've attached an image of the Phase 2 selectors (using named address)

     


     

    Attached Image(s)

    #3
    rwpatterson
    Expert Member
    • Total Posts : 8419
    • Scores: 197
    • Reward points: 0
    • Joined: 2006/08/08 10:08:18
    • Location: Long Island, New York, USA
    • Status: offline
    Re: VPN site to site issues 2019/07/10 08:32:17 (permalink)
    0
    You also need to have static routes in place for those remote networks that point down the tunnels. Make sure the distance is lower than the default gateway.
     
    Also ensure that you have policies in place that start from your side for outgoing originating traffic as well as policies that start from the remote side for incoming originating traffic.
    post edited by rwpatterson - 2019/07/10 08:34:17

    -Bob - self proclaimed posting junkie!
    See my Fortigate related scripts at: http://fortigate.camerabob.com

    -4.3.19-b0694
    FWF60B
    FWF80CM (4)
    FWF81CM (2)
     
    #4
    hubertzw
    Gold Member
    • Total Posts : 193
    • Scores: 5
    • Reward points: 0
    • Joined: 2018/04/16 13:29:04
    • Status: offline
    Re: VPN site to site issues 2019/07/10 09:36:59 (permalink)
    0
    In the first post you said you can ping 3 IPs from the FGT but I don't see in the attached outputs. I'm asking for it just to be sure routing on the FGT is correct (Robert also mentioned about it in his last post).
    Are the three IPs from the same subnet as the one in the last post (10.254.0.2)?
     
    When you don't see any traffic you can check why:
     
    diag debug flow filter addr 10.254.0.2
    diag debug flow show console enable
    diag debug flow show function-name enable
    diag debug flow trace start 100
    diag debug enable
     
    Sometimes it's routing or missing policy. When you use VPN wizard all components are added automatically (routing, policies).
     
    Usually you shouldn't be able to ping remote host from the FGT as it requires additional firewall policy. Do the test from the server, make sure the routing is correct pointing to the FGT and on the FGT you send traffic to the tunnel.
     
     
     
     
    #5
    Jump to:
    © 2019 APG vNext Commercial Version 5.5