Fortigate to Meraki IPsec - traffic only going one way

[GregoryW]

Hi,

I'm just configuring a Meraki to Fortigate VPN, and I'm running into an issue where traffic seems to be blocked from reaching the meraki. I'm able to have the IPSEC tunnel be established and stable. From the meraki side, I'm able to ping, rdp, etc. into the FortiGate office

I'm not able to do anything from the fortigate side. Toggling the fortigate-local to meraki-remote firewall policy doesn't even make a difference. (still able to stay connected via rdp too) 

When I try to add a firewall exception on the meraki, i get an error that the address ranges does not apply to any configured local or vpn subnets.

When I look at the meraki route tables, It says no data.

Just looking for some help

Thanks, 

[Bruce]

My gut feel here is that this is something on the Fortigate side. If the VPN is coming up and you are able to ping and RDP from the Meraki to the Fortigate then traffic is travelling successfully in both directions over the connection. This would lead me to believe that there is a firewall rule on the Fortigate that is blocking traffic that is originating on the other side.

The Meraki firewall rule error is because that subnet isn’t local, it’s at the remote site, and those rules don’t apply to VPN traffic. By default the Meraki MX will allow all traffic over the VPN to a learnt remote subnet (you can change this on the site-to-site VPN page, with the site-to-site outbound firewall rules).

[GregoryW]

Here's how we have the fortigate rules configured

We also tried to used the fortigate wizard to autocreate all required objects, got it switched to a custom ipsec tunnel, but still no luck 

[General-Zod · Accepted solution]

Greetings @GregoryW 

Can you please disable NATing on your fortigate IPsec firewall policy. Local>remote

Your IPsec interface on the fortigate doesn’t have a ip associated with it (unless you have configured one) so the NAT function won’t do you any good. 

This would also explain why traffic initiated from the Meraki to Fortigate is working. The fortigate IPsec firewall Policy remote>Local should also have NAT disabled, however it’s still working as the egress interface “local-lan” does have a ip attached to its interface.

make sense?

[PhilipDAth]

Are you sure it' not something simple like Windows Firewall on your end stopping it from working?

[GregoryW]

Tried that. Also I'm trying to reach non-server devices, like switches or routers with no success. Also tried two different ISPs to make sure it wasn't a ISP firewall causing issue