SDWAN - IPSec Tunnel Mode does no access XG GUI

Hello Carlos Cesario ,

Thank you for reaching out to the community,  Under the Administration > Device access > under the VPN zone is HTTPS section ticked ?

Hi Vivek Jagad ,

Thank you by your reply. 

Yes, it is ticked

Regards

Carlos

Under command-line interface (CLI) and choose option 4. Device Console.
console> system diagnostics utilities route lookup <BO GUI IP> 
can you share the output ?

Sure,

Regards

So here Carlos Cesario  the problem is traffic is going out from Port3 , try adding a IPsec route. 
console> system ipsec_route show
console> system ipsec_route add net 10.x.x.x/255.x.x.x tunnelname IPsecTunnel (name of the IPsec tunnel)

 Vivek Jagad 

Thank you by your answer. But it seems that is not solution.

Let me explain the other tests

When I access the other host from HO to BO, it works and the route is the same path

The tracert from Host on HO Side

And the SSH from the host from HO to XG device on BO side using VPN it works. 

Regards

Carlos

Okay can you validate if the rules are proper on HO and BO i.e. 

1.) LAN to VPN
2.) VPN to LAN 

Ensure the rules are on the top !

then after can you share the packet capture output ?

Hi Vivek Jagad ,

Sure, the LAN to VPN and VPN to LAN rules are OK.

Let me share one more thing that I discover in the tests.

If I access (via RDP) one machine from HO to BO and keep the session connected I got access on XG GUI from HO to BO, If disconnect from RDP, the access to XG GUI stop to works after 5 minutes +/-
Very crazy.

Packet Capture from HO to BO 

Packet Capture from HO to BO after establish RDP session 

Regards

Carlos

Indeed this is unusual, I'd suggest you to log a service request to investigate this further , revert me with the case id once raised, I'll expedite the investigation for you ! 

Do you use the SD-WAN Policies? Could you try to change to active/backup? If this fixes your problem, you are affected by a known issue: (NC-114075) Issue with connectivity when using IPsec RBVPN with SD-WAN Routes/Profiles

Please open a Support Case to get a hotfix.