after update to fortios 7.0.13 site to site vpn not working

[m_esmat25]

HI,

please help me as after update to fortios 7.0.13 site to site vpn site1 is E100 and site 2 E30 the VPN connection is up but no any traffic or services working between the 2 sities

Thanks,

[smaruvala]

Hi, 

- Was the upgrade done on both Site1 and Site2?

- Does the issue gets resolved when you downgrade to older version such as 7.0.12?

- Have you tried to check the sniffer for the communication on both the Firewall?

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Packet-capture-sniffer/ta-p/198313

- Is it possible to disable the NP offload and verify if the issue is still seen in 7.0.13? You may have to flap the VPN once the settings are changed.

https://docs.fortinet.com/document/fortigate/7.0.13/hardware-acceleration/636026

Regards,

Shiva

[xshkurti]

@m_esmat25 
Are you using any type of ippool or vip for specific vpn tunnels?

Please check this link for more info about change in behavior:

Technical Tip: ARP reply setting in Virtual IP/IP ... - Fortinet Community

Regards,

[mle2802]

Hi @m_esmat25,

In addition to @xshkurti, reply, you can run debug flow when try to pass traffic through the tunnel and see if reply traffic sent to "root" instead:

diag debug reset
diag debug flow filter addr X.X.X.X (source or destination IP)
diag debug flow filter proto 1
diag debug flow show ip en
diag debug flow show func en
diag debug console time ena
diag debug ena
diag debug flow trace start 999

Regards,
Minh

[m_esmat25]

Thanks for all, and i will downgrade to older version 7.0.12 and check the iusse .

[Nchandan]

You can also be able to understand if the pack is going out of one FortiGate to another FortiGate and understand by running the sniffer as well.

diagnose sniffer packet any "host a.a.a.a  and icmp" 6 0 a

Where a.a.a.a is the destination IP address to where you are initiating the ping to 

You will be able to understand the issue is happening from which FortiGate and troubleshoot accordingly.

[pavankr5]

Hello @m_esmat25 

If Phase2 is up but traffic is not passing.

1) Make sure the quick mode selector defined in Phase2 is configured properly to allow the traffic flow.

2) Check the IPv4 policies and confirm:

a) If there is policy defined for this traffic flow.
b) If there are any source and destination addresses defined, make sure it is configured to allow this traffic flow.
please check this document for reference
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Troubleshooting-IPsec-Site-to-Site-T...
let us know if you have any queries.

Thanks,
Pavan