FortiGate VM IPSec Tunnel Up but No Traffic

It sounds like you're experiencing a common issue with AWS Site-to-Site VPN connections where the IPSec tunnel is established but traffic isn't flowing. Here are some steps you can take to troubleshoot this issue:

1. Verify routing configuration: Ensure that the route tables in your VPC are correctly configured to route traffic destined for the on-premises network through the FortiGate VM VPN connection and FortiGate VM has necessary policies to send the traffic to instances behind the VM. Also, check that the on-premises device has the correct static routes for the AWS VPC CIDR pointing to the VPN virtual tunnel interface.

2. Check security groups and network ACLs: While you mentioned verifying the ACL and security group, double-check that they allow the necessary inbound and outbound traffic for the specific protocols and ports your applications need.

3. Verify VPN connection configuration: Make sure that the VPN connection includes a static route for the on-premises network in your FortiGate VM. Also, confirm that the security associations and traffic selectors match on both the FortiGate VM and On-premise Device.

4. Check FortiGate configuration: Review the IPsec debug logs on the FortiGate VM for any errors related to the connection failure. Ensure that the Phase 2 parameters on the On-premise FortiGate device match with the VPN's tunnel settings in FortiGate VM.

If after checking these items you're still unable to resolve the issue, you may need to engage AWS support or a networking specialist along with FortiGate Support team to help identify any subtle misconfigurations or compatibility issues.

Sources
Troubleshoot VPN routing issues | AWS re:Post
Troubleshoot IPsec/Phase2 failure | AWS re:Post