AWS Fortigate S2S directionality issue...

Question

I have an AWS to on-premise Fortigate site-to-site tunnel (static routing) configured and up. I could only pass traffic in the AWS-to-Fortigate direction after sending traffic in the Fortigate-to-AWS direction. Why is this? Is there a tunnel activity timeout involved?

Tushar Jagdale · Answer

Hello,

Suggest checking the troubleshooting steps listed in the below Knowledge center article:

https://aws.amazon.com/premiumsupport/knowledge-center/vpn-cgw-vpg-traffic/

Brettski · Answer

When I see this is says to me "NAT is happening in the Fortigate firewall". Make sure that you've disabling any address translation on the VPN connection or for the IP ranges in question.

The other common issue is that the AWS side is not configured to initiate the VPN connection which means it must be created from the Fortigate side. Our documentation talks to how to configure tunnel initiation: https://docs.aws.amazon.com/vpn/latest/s2svpn/initiate-vpn-tunnels.html

AWS Fortigate S2S directionality issue...

Add your answer

Relevant content