Hot!site to site vpn tunnel is up but no traffic flowing

Page: < 12 Showing page 2 of 2
Author
zaphod
New Member
  • Total Posts : 20
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/08/19 01:42:28
  • Status: offline
Re: site to site vpn tunnel is up but no traffic flowing 2019/08/20 00:21:36 (permalink)
0
ahhh you use sdwan... important information for support..
 
look at this and compare your config
 
https://kb.fortinet.com/kb/documentLink.do?externalID=FD41297
 
greets
 
zaphod
 
#21
rwpatterson
Expert Member
  • Total Posts : 8411
  • Scores: 195
  • Reward points: 0
  • Joined: 2006/08/08 10:08:18
  • Location: Long Island, New York, USA
  • Status: offline
Re: site to site vpn tunnel is up but no traffic flowing 2019/08/20 04:43:53 (permalink)
0
fortinoy
the route to the internet is 0.0.0.0/0 via sd wan which has an administrative distance of 1. the route of the tunnel is remote LAN subnet via tunnel interface with an administrative distance of 10. so should we put a 1 on the route to the tunnel and 10 on the route to the internet?

The default gateway is the the gateway of last resort. If the distance is 1, then no traffic will ever go anywhere else. Make that distance greater than the distance of any other location you wish to reach or that traffic will simply go out the default gateway and get dropped at the ISP.

-Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

-4.3.19-b0694
FWF60B
FWF80CM (4)
FWF81CM (2)
 
#22
zaphod
New Member
  • Total Posts : 20
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/08/19 01:42:28
  • Status: offline
Re: site to site vpn tunnel is up but no traffic flowing 2019/08/20 04:51:25 (permalink)
0
@rwpatterson
in sd-wan environment it is normal that the defaultroute has a distance with 1, all static routes get 10
i have checked one of ny sdwan branches and it is the same.
 
but in sdwan you need to handle ipsec vpns other than without sdwan.. think that is the problem here... 
i have posted a kb article which describes a how to...
 
greets
 
zaphod
 
 
 
 
#23
rwpatterson
Expert Member
  • Total Posts : 8411
  • Scores: 195
  • Reward points: 0
  • Joined: 2006/08/08 10:08:18
  • Location: Long Island, New York, USA
  • Status: offline
Re: site to site vpn tunnel is up but no traffic flowing 2019/08/20 06:51:34 (permalink)
0
zaphod
@rwpatterson
in sd-wan environment it is normal that the defaultroute has a distance with 1, all static routes get 10
i have checked one of ny sdwan branches and it is the same.
 
but in sdwan you need to handle ipsec vpns other than without sdwan.. think that is the problem here... 
i have posted a kb article which describes a how to...
 
greets
 
zaphod

OK. I'm still learning after all these years...

-Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

-4.3.19-b0694
FWF60B
FWF80CM (4)
FWF81CM (2)
 
#24
zaphod
New Member
  • Total Posts : 20
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/08/19 01:42:28
  • Status: offline
Re: site to site vpn tunnel is up but no traffic flowing 2019/08/20 06:54:13 (permalink)
0
me too :-)
#25
OneOfUs
Bronze Member
  • Total Posts : 30
  • Scores: 6
  • Reward points: 0
  • Joined: 2019/07/16 06:32:59
  • Status: offline
Re: site to site vpn tunnel is up but no traffic flowing 2019/08/21 06:35:47 (permalink)
0
From the logs it looks like the Phase 1 / Phase 2 come up and negotiate successfully, but I saw this:
recv IPsec SA delete, spi count 1
 
It appears the disconnect is being initiated from the peer.  Can you run the same debugs on the remote side?
#26
brycemd
Silver Member
  • Total Posts : 75
  • Scores: 4
  • Reward points: 0
  • Joined: 2016/12/03 11:24:30
  • Status: offline
Re: site to site vpn tunnel is up but no traffic flowing 2019/08/21 13:43:14 (permalink)
0
rwpatterson
fortinoy
The administrative distance of the static route for the tunnel is 10. We have a static route with a lower administrative distance than the tunnel at both ends.

That makes no sense. The static route for the tunnel needs to have a lower administrative distance than the DEFAULT route, which was not mentioned.


It always routes based on the most specific route, then distance if there are equally specific routes. Every route takes priority over 0.0.0.0
#27
fortinoy
New Member
  • Total Posts : 16
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/08/14 01:33:31
  • Status: offline
Re: site to site vpn tunnel is up but no traffic flowing 2019/08/21 19:06:59 (permalink)
0
Here is the debug from the remote Fortigate:
 
FG100ETK18010728 $ ike 0: comes REMOTE WAN IP:500->LOCAL WAN IP:500,ifindex=7....
 
ike 0: IKEv2 exchange=INFORMATIONAL_RESPONSE id=40699c6066b7a5dc/d7f17ef590733f17:00000001 len=76
 
ike 0:REMOTE VPN NAME:13: received informational response
 
ike 0:REMOTE VPN NAME:13:24: processing informational acknowledgement
 
ike 0:REMOTE VPN NAME:13: processing delete ack (proto 3)
 
ike 0:REMOTE VPN NAME:REMOTE VPN NAME:23: send SA_DONE SPI 0xc219d81
 
ike 0:REMOTE VPN NAME: SA_DONE failed. SPI 0xc219d81, error 2: No such file or directory
 
ike 0:REMOTE VPN NAME: deleting IPsec SA with SPI 0c219d81
 
ike 0: comes REMOTE WAN IP:500->LOCAL WAN IP:500,ifindex=7....
 
ike 0: IKEv2 exchange=CREATE_CHILD id=40699c6066b7a5dc/d7f17ef590733f17:00000003 len=460
 
ike 0:REMOTE VPN NAME:13: received create-child request
 
ike 0:REMOTE VPN NAME:13: responder received CREATE_CHILD exchange
 
ike 0:REMOTE VPN NAME:13: responder creating new child
 
ike 0:REMOTE VPN NAME:13:25: peer proposal:
 
ike 0:REMOTE VPN NAME:13:25: TSi_0 0:REMOTE LAN IP-REMOTE LAN IP:0
 
ike 0:REMOTE VPN NAME:13:25: TSr_0 0:LOCAL LAN IP-LOCAL LAN IP:0
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: comparing selectors
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: matched by rfc-rule-2
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: phase2 matched by subset
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: accepted proposal:
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: TSi_0 0:REMOTE LAN IP-REMOTE LAN IP:0
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: TSr_0 0:LOCAL LAN IP-LOCAL LAN IP:0
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: autokey
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: incoming child SA proposal:
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: proposal id = 1:
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25:   protocol = ESP:
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25:      encapsulation = TUNNEL
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25:         type=ENCR, val=AES_CBC (key_len = 128)
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25:         type=INTEGR, val=SHA
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25:         type=DH_GROUP, val=MODP2048
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25:         type=ESN, val=NO
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: matched proposal id 1
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: proposal id = 1:
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25:   protocol = ESP:
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25:      encapsulation = TUNNEL
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25:         type=ENCR, val=AES_CBC (key_len = 128)
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25:         type=INTEGR, val=SHA
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25:         type=DH_GROUP, val=MODP2048
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25:         type=ESN, val=NO
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: lifetime=43200
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: PFS enabled, group=14
 
ike 0:REMOTE VPN NAME: schedule auto-negotiate
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: set sa life soft seconds=42927.
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: set sa life hard seconds=43200.
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: IPsec SA selectors #src=1 #dst=1
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: src 0 7 0:LOCAL LAN IP-LOCAL LAN IP:0
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: dst 0 7 0:REMOTE LAN IP-REMOTE LAN IP:0
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: add IPsec SA: SPIs=82229bb1/0c219d82
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: added IPsec SA: SPIs=82229bb1/0c219d82
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: sending SNMP tunnel UP trap
 
ike 0:REMOTE VPN NAME:13:REMOTE VPN NAME:25: responder preparing CREATE_CHILD message
 
ike 0:REMOTE VPN NAME:13: sent IKE msg (CREATE_CHILD_RESPONSE): LOCAL WAN IP:500->REMOTE WAN IP:500, len=460, id=40699c6066b7a5dc/d7f17ef590733f17:00000003
 
ike shrank heap by 126976 bytes
 
 
 
#28
fortinoy
New Member
  • Total Posts : 16
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/08/14 01:33:31
  • Status: offline
Re: site to site vpn tunnel is up but no traffic flowing 2019/08/22 01:58:38 (permalink)
0
regarding the config on the KB, it has 2 tunnel interfaces. our setup only has 1 tunnel interface. sdwan was only used for the default route for the internet. the tunnel was still bind under wan 1. i tried adding sd wan rules for the internet and access to the lan traffic but same issue.
 
i will try to post pics here of our setup.
 
attach here is our static route
 

Attached Image(s)

#29
fortinoy
New Member
  • Total Posts : 16
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/08/14 01:33:31
  • Status: offline
Re: site to site vpn tunnel is up but no traffic flowing 2019/08/22 02:00:43 (permalink)
0
looks like i can only attach one pic at a time.
 
here is the policy from remote to local LAN
 
 

Attached Image(s)

#30
fortinoy
New Member
  • Total Posts : 16
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/08/14 01:33:31
  • Status: offline
Re: site to site vpn tunnel is up but no traffic flowing 2019/08/23 01:02:00 (permalink)
0
UPDATE:
 
from the remote fortigate CLI, i can ping the server behind the local fortigate. however, i cannot ping the pc behind the remote fortigate from the CLI of local fortigate.
 
if i ping the server behind the local fortigate using a pc behind the remote fortigate, it fails. i also cannot ping a pc from the remote fortigate using the server behind the local fortigate.
 
Here is the latest debug on the remote fortigate:
 
FG100ETK18010728 $ ike 0:REMOTE  VLAN NAME:REMOTE  VLAN NAME:2: admin flush IPsec SA
ike 0:REMOTE  VLAN NAME: flushing REMOTE  VLAN NAME
ike 0:REMOTE  VLAN NAME: deleting IPsec SA with SPI 0c21a003
ike 0:REMOTE  VLAN NAME:REMOTE  VLAN NAME: deleted IPsec SA with SPI 0c21a003, SA count: 0
ike 0:REMOTE  VLAN NAME: sending SNMP tunnel DOWN trap for REMOTE  VLAN NAME
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:703: sending delete for IPsec SA SPI dec858ab
ike 0:REMOTE  VLAN NAME:610:704: send informational
ike 0:REMOTE  VLAN NAME:610: sent IKE msg (INFORMATIONAL): REMOTE  WAN IP:500->LOCAL  WAN IP:500, len=80, id=8483ff7338bdefcc/77459347bf53a36f:00000003
ike 0:REMOTE  VLAN NAME:REMOTE  VLAN NAME: sending SNMP tunnel DOWN trap
ike 0:REMOTE  VLAN NAME: deleting IPsec SA with SPI 0c21a003
ike 0:REMOTE  VLAN NAME: flushed REMOTE  VLAN NAME
ike 0: comes LOCAL  WAN IP:500->REMOTE  WAN IP:500,ifindex=7....
ike 0: IKEv2 exchange=INFORMATIONAL_RESPONSE id=8483ff7338bdefcc/77459347bf53a36f:00000003 len=80
ike 0:REMOTE  VLAN NAME:610: received informational response
ike 0:REMOTE  VLAN NAME:610:704: processing informational acknowledgement
ike 0:REMOTE  VLAN NAME:610: processing delete ack (proto 3)
ike 0:REMOTE  VLAN NAME: deleting IPsec SA with SPI 0c21a003
ike 0:REMOTE  VLAN NAME:REMOTE  VLAN NAME: IPsec SA connect 7 REMOTE  WAN IP->LOCAL  WAN IP:0
ike 0:REMOTE  VLAN NAME:REMOTE  VLAN NAME: using existing connection
ike 0:REMOTE  VLAN NAME:REMOTE  VLAN NAME: config found
ike 0:REMOTE  VLAN NAME:REMOTE  VLAN NAME: IPsec SA connect 7 REMOTE  WAN IP->LOCAL  WAN IP:500 negotiating
ike 0:REMOTE  VLAN NAME:610:705 initiating CREATE_CHILD exchange
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: PFS enabled
ike 0:REMOTE  VLAN NAME:610: sent IKE msg (CREATE_CHILD): REMOTE  WAN IP:500->LOCAL  WAN IP:500, len=480, id=8483ff7338bdefcc/77459347bf53a36f:00000004
ike 0: comes LOCAL  WAN IP:500->REMOTE  WAN IP:500,ifindex=7....
ike 0: IKEv2 exchange=CREATE_CHILD_RESPONSE id=8483ff7338bdefcc/77459347bf53a36f:00000004 len=464
ike 0:REMOTE  VLAN NAME:610: received create-child response
ike 0:REMOTE  VLAN NAME:610: initiator received CREATE_CHILD msg
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: found child SA SPI dec858ac state=3
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: PFS enabled, group=14
ike 0:REMOTE  VLAN NAME:610:705: peer proposal:
ike 0:REMOTE  VLAN NAME:610:705: TSr_0 0:0.0.0.0-255.255.255.255:0
ike 0:REMOTE  VLAN NAME:610:705: TSi_0 0:0.0.0.0-255.255.255.255:0
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: comparing selectors
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: matched by rfc-rule-2
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: phase2 matched by subset
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: accepted proposal:
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: TSr_0 0:0.0.0.0-255.255.255.255:0
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: TSi_0 0:0.0.0.0-255.255.255.255:0
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: autokey
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: incoming child SA proposal:
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: proposal id = 1:
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:   protocol = ESP:
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:      encapsulation = TUNNEL
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=ENCR, val=AES_CBC (key_len = 256)
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=INTEGR, val=SHA256
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=DH_GROUP, val=MODP2048
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=ESN, val=NO
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: matched proposal id 1
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: proposal id = 1:
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:   protocol = ESP:
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:      encapsulation = TUNNEL
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=ENCR, val=AES_CBC (key_len = 256)
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=INTEGR, val=SHA256
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=DH_GROUP, val=MODP2048
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=ESN, val=NO
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: lifetime=28800
ike 0:REMOTE  VLAN NAME: schedule auto-negotiate
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: replay protection enabled
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: set sa life soft seconds=28500.
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: set sa life hard seconds=28800.
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: IPsec SA selectors #src=1 #dst=1
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: src 0 7 0:0.0.0.0-255.255.255.255:0
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: dst 0 7 0:0.0.0.0-255.255.255.255:0
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: add IPsec SA: SPIs=dec858ac/0c21a004
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: added IPsec SA: SPIs=dec858ac/0c21a004
ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: sending SNMP tunnel UP trap
ike shrank heap by 126976 bytes
ike 0:REMOTE  VLAN NAME: link is idle 7 REMOTE  WAN IP->LOCAL  WAN IP:0 dpd=2 seqno=57
ike 0:REMOTE  VLAN NAME:610: send IKEv2 DPD probe
ike 0:REMOTE  VLAN NAME:706: sending NOTIFY msg
ike 0:REMOTE  VLAN NAME:610:706: send informational
ike 0:REMOTE  VLAN NAME:610: sent IKE msg (INFORMATIONAL): REMOTE  WAN IP:500->LOCAL  WAN IP:500, len=80, id=8483ff7338bdefcc/77459347bf53a36f:00000005
ike 0: comes LOCAL  WAN IP:500->REMOTE  WAN IP:500,ifindex=7....
ike 0: IKEv2 exchange=INFORMATIONAL_RESPONSE id=8483ff7338bdefcc/77459347bf53a36f:00000005 len=80
ike 0:REMOTE  VLAN NAME:610: received informational response
ike 0:REMOTE  VLAN NAME:706: received NOTIFY acknowledgement
ike 0:REMOTE  VLAN NAME:610:706: processing informational acknowledgement
ike 0: comes LOCAL  WAN IP:500->REMOTE  WAN IP:500,ifindex=7....
ike 0: IKEv2 exchange=INFORMATIONAL id=8483ff7338bdefcc/77459347bf53a36f:00000004 len=80
ike 0:REMOTE  VLAN NAME:610: received informational request
ike 0:REMOTE  VLAN NAME:610: sent IKE msg (INFORMATIONAL_RESPONSE): REMOTE  WAN IP:500->LOCAL  WAN IP:500, len=80, id=8483ff7338bdefcc/77459347bf53a36f:00000004
 
 Hope you guys will continue to help me check. Thanks.
#31
smari
Bronze Member
  • Total Posts : 25
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/11/10 01:11:11
  • Location: Iceland
  • Status: offline
Re: site to site vpn tunnel is up but no traffic flowing 2019/08/27 04:43:07 (permalink)
0
You should not have to make any changes to the administrative distance if the route to the tunnel is more specific than the default route.

NSE7, FMG, FAC, FAZ .
1500D's, 1200D's, 900D's, 300D's, 200D's, 100D's and bunch of small stuff.
 
#32
Page: < 12 Showing page 2 of 2
Jump to:
© 2019 APG vNext Commercial Version 5.5