Problem vpn L2L ASA with Fortigate 100

[alfredoelias]

the VPN is UP phase 1 ok, phase 2 OK, but when I ping the network I want to reach the side of the FortiGate lose the connection and I do not answer the ping. The vpn is up but I deny the connection FortiGate.

Thanks.

[Federico Coto Fajardo]

Hi,

Make sure on the Fortigate there's no filtering VPN traffic (there should be a rule permitting the VPN).

Phase 1 and 2 show established on both ends?

Federico.

[alfredoelias]

Hi,

Actually phase 1 and phase 2 were established on both sides in both the ASA and in the FortiGate but since the network allowed in the ASA I can not ping allowed networks in the FortiGate. And the vpn is up forever.

Thanks.

[Federico Coto Fajardo]

If phase 2 is established you can do this test.

PING from the ASA side to the Fortigate...

do you see packets encrypted through the tunnel ''sh cry ips sa''?

do you see packets coming back (decrypted)?

PING from the Fortigate side to the ASA...

do you see packets decrypted through the tunnel ''sh cry ips sa''?

The above will show you who is and who is not sending packets, so you can check where the problem is.

Sometimes is a route.. sometimes is a filter/rule not allowing the traffic.

Federico.