Hot!ipsec site to site vpn

Author
Wazaq
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/02/17 07:47:18
  • Status: offline
2020/02/17 08:30:03 (permalink) 6.2
0

ipsec site to site vpn

Hi,
i created a site to site vpn with a 4g router on each side and the fortinet router linked to it however the two fortinet routers can be seen since the vpn is up but the ping does not work. Both fortinet have the same configuration.
I post you the fortinet conf image.

Attached Image(s)

#1
sw2090
Platinum Member
  • Total Posts : 551
  • Scores: 39
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: ipsec site to site vpn 2020/02/17 23:51:55 (permalink)
0
Since you say the tunnel is up (the pic shows that too) I would recommed to the some flow debugging on one or evn both FGT involved in order to see what happens to your traffic going over the tunnel.
 
diag debug ena
diag debug flow filter clear
diag debug flow filter daddr <iponremotesubnet>
diag debug flow trace start 10000
 
then ping the Ip you specified in the filter from a client that should be able to piing it and watch the console.
You will see what happens to the traffic.
Once you see it went out over the tunnel, do the same on the opposite FGT.
Maybe with filter set to saddr <ipofclientyouarepinging from).
 
#2
Wazaq
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/02/17 07:47:18
  • Status: offline
Re: ipsec site to site vpn 2020/02/18 02:47:31 (permalink)
0
Thanks for your reply, I did the commands and ping and here are the results:
 
FGT50E5619045241 # id=20085 trace_id=1 func=print_pkt_detail line=5501 msg="vd-root:0 received a packet(proto=1, 192.168.0.10:1->192.168.3.10:2048) from lan. type=8, code=0, id=1, seq=17."
id=20085 trace_id=1 func=init_ip_session_common line=5666 msg="allocate a new session-000054e0"
id=20085 trace_id=1 func=vf_ip_route_input_common line=2596 msg="find a route: flag=04000000 gw-192.168.3.10 via VEZIN-4G-4G"
id=20085 trace_id=1 func=fw_forward_handler line=771 msg="Allowed by Policy-2: SNAT"
id=20085 trace_id=1 func=__ip_session_run_tuple line=3286 msg="SNAT 192.168.0.10->192.168.1.253:60417"
id=20085 trace_id=1 func=ipsecdev_hard_start_xmit line=777 msg="enter IPsec interface-VEZIN-4G-4G"
id=20085 trace_id=1 func=ipsec_common_output4 line=876 msg="No matching IPsec selector, drop"
 
Is the VEZIN-4G-4G interface badly configured?
I have attached the network diagram.

Attached Image(s)

#3
sw2090
Platinum Member
  • Total Posts : 551
  • Scores: 39
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: ipsec site to site vpn 2020/02/18 05:23:51 (permalink)
0
Looks like something is screwed up with your Tunnels phase2 IP selectors...
#4
pmandava_FTNT
New Member
  • Total Posts : 11
  • Scores: 2
  • Reward points: 0
  • Joined: 2018/10/12 00:24:40
  • Status: offline
Re: ipsec site to site vpn 2020/02/24 13:20:18 (permalink)
0
Hi Wazaq,
 
It looks like you have the required firewall policy to allow the traffic but the matching Phase 2 selector is missing. Can you share the vpn configuration?
 
-prithvi
#5
Wazaq
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/02/17 07:47:18
  • Status: offline
Re: ipsec site to site vpn 2020/02/26 02:09:10 (permalink)
0
Hello, quick update, it was just necessary to deactivate the NAT of the lan to the remote.
Thanks for your help.
#6
sw2090
Platinum Member
  • Total Posts : 551
  • Scores: 39
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: ipsec site to site vpn 2020/02/26 04:14:56 (permalink)
0
Probably this is due to your NAT settings on the policy. The logs show the traffic gets SNATed before it goes to the IPSec tunnel. Maybe due to this the phase2 selectors do not match anymore?
#7
Wazaq
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/02/17 07:47:18
  • Status: offline
Re: ipsec site to site vpn 2020/02/26 07:15:20 (permalink)
0
The phase 2 is corect, just activate NAT in policies on remote subnet to LAN rule the problem is solved.
#8
Jump to:
© 2020 APG vNext Commercial Version 5.5