Kernaali ToolsA working IPsec tunnel may protect the old subnet while the new one has no matching Child SA, route or policy. Follow one client-to-server flow across both gateways. Change the first proven mismatch, then retest the existing networks too.
Applies to: FortiGate route-based site-to-site IPv4 VPN; FortiOS 7.4.4 phase 2 and diagnostic documentation. One new non-overlapping subnet; deliberate overlapping-address NAT designs and FortiClient split tunneling are separate tasks.
Validation: documentation-checked on . No device or lab test is claimed. Version references identify the documentation checked, not a firmware upgrade recommendation.
Define one flow and compare both gateways
Synthetic example: a new client network 192.0.2.0/24 at Site A needs HTTPS to 198.51.100.10 in Site B’s 198.51.100.0/24. Record the client’s actual source address, destination, TCP port and default gateway. Keep an old working client as a control. Do not use firewall-originated ping as the only test.
Read the existing phase 2 settings on each gateway. On A, the new local selector must cover the client and the remote selector the server. B sees those roles reversed. If named address groups are used, inspect their members and confirm that the other vendor supports the negotiated selectors. FortiOS phase 2 documentation explains specific selectors and address-group interoperability.
Is the correct Child SA carrying the test?
diagnose vpn tunnel list name <existing-tunnel>Inspect locally; do not share raw SA output. Find the selector that covers this exact pair, its SA state and the change in encrypt/decrypt counters during a short test. A phase 1/IKE SA or another selector’s counters do not answer this question. If the required SA is absent, inspect the peer’s matching selector and proposal, then use bounded IKE debug.
| Evidence from the same test interval | Next branch |
|---|---|
| No encryption for the new client | Check local route, selected interface, policy hit and NAT |
| A encrypts; B does not decrypt | Check peer/tunnel selection and outer packet delivery |
| B decrypts but server sees no request | Check B forwarding policy, route and server-side path |
| Server receives request but A sees no return decryption | Trace server gateway, B return route/policy and reverse selector |
| Both directions carry data, application still fails | Check host firewall, TLS/service response and size-dependent symptoms |
Routes, permissions and translation are separate checks
Look up the server address in A’s active routing table and inspect policy routes that can select a different egress. On B, check both the server route and the return route to the actual client source. Work in the correct VDOM on each side. The route merely chooses a path; it does not grant access.
Inspect the effective ordered policy for each direction that must initiate a session. Permit the intended source, destination and service, with stateful replies. Check whether a broad Internet NAT rule translates this flow unexpectedly. Keep intentional NAT intact; selectors and routes must describe the addresses actually used at each stage.
Make a limited correction and prove it
If a selector pair is missing, add the agreed pair on both peers and the necessary narrow route/policy. If selectors already cover it, leave them alone and correct the failed route or permission instead. Record old object members and policy order before editing shared groups: changing one can affect several services. Use independent management and a change window if routes or active SAs can be disturbed.
Success means an authenticated application transaction from the new network, replies on the intended path, continued old-subnet service and failure of an intentionally disallowed test. A CIDR set comparison can find a missing prefix but cannot validate routing or policy execution.
Rollback: undo only the added subnet’s selector, route or policy changes, restoring saved group members and order. Do not delete shared objects or clear the global session table. Stop any debug using its own cleanup procedure.
Inspect negotiation · Compare protected subnet lists · Investigate overhead after a size-dependent finding
Technical references
Found an issue? Send a correction with a reproducible example.