IT Toolbox
Guide

How to diagnose a connected VPN without access to the LAN

The tunnel can be established while routing, policies or DNS still prevent access to resources.

TopicFortiGate →
⌚ About 2 min read
View my favorites
VPN Intermediate. 20 min

The tunnel can be established while routing, policies or DNS still prevent access to resources.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Note the IP VPN.

    Check the pool and bridge.

  2. 2

    Test IP LAN.

    Move the DNS away.

  3. 3

    Read the road table.

    Drive the road to the LAN.

  4. 4

    Checking forGarten.

    Control policy and return traffic.

Commands utiles

road print.
tracet 192.168.1.1

À retenir

  • Test first by IP.
  • Be careful about overlapping sub-networks.
← All les guides
Technical deep dive

FortiGate IPsec: Phase 1, Phase 2 and traffic are three separate validations

Technical checkpoints

  • Phase 1 validates IKE/peer/authentication; Phase 2 validates IPsec SAs/selectors. An “up” tunnel can still carry no traffic.
  • NAT-T uses UDP/4500 when NAT
  • Routes, policies, NAT and selectors must match the real traffic in both directions.

Targeted CLI

Read gateways/SAs then filter debug on the peer instead of enabling unbounded global IKE debug.

get vpn ipsec tunnel summary
diagnose vpn ike gateway list
diagnose vpn tunnel list

Topic-specific pitfalls

  • A FortiGate ping without a source can use a different interface than user traffic.
  • Phase 2 can be down because of selectors/proposals while Phase 1 is completely healthy.

How to validate

  • Expected SAs are up and RX/TX counters increase during the real traffic test.
  • Policy, route and session show the expected path without unintended NAT.
♡ 0