Problem with ipsec tunnel mikrotik fortigate

[Bladek]

Hello i have a litle problem. Tunnel is establised but fortigate cant ping mikrotik and mikrotik cant ping fortigate.

1. Mikrotik LTE 192.168.77.1 is connect to fortigate via ethernet cable. Fortigate have address 192.168.11.254. And to mikrotik connect via ethernet cable PC1 and he have address from fortigate 192.168.11.110

2. Mikrotik LTE2 192.168.14.254 and he cant ping 192.168.11.254 but PC2 connect wireless from mikrotik lte2 and have ip 192.168.14.100and he pinging 192.168.11.254 (frotigate)

What is wrong? I use NAT-T to ipsec

[abarushka]

Hello,

I would recommend to collect debug flow and traffic sniffer in order to check whether traffic is reaching FortiGate, entering the tunnel and return traffic. In case there is no return traffic I would recommend to check whether traffic is received on Mikrotik site. In case traffic is lost between FortiGate and Mikrotik you may consider to decrypt ESP packets. Please find the details by following the link below:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Decrypt-ESP-packets/ta-p/198431?externalID...

[seshuganesh]

Hi Team,

I will request you to provide the network diagram and along with provide these debug flow logs:

diag debug reset

diag debug disable

diag debug flow filter addr a.b.c.d (where a.b.c.d is the destination ip to which you are pinging)

diag debug flow show function-name enable

diag debug flow trace start 10000

diag debug enable

Once you collect required logs, you can disable debug by typing this command "diag debug disable"

Please share the debug with us