Client -> VPN -> FG1 -> FG2 -> Server
- Created a VPN tunnel with remote IP 10.20.30.4/32 and local ip 10.20.30.40/32
- on FG1, NAT/VIP is established with VIP as 10.20.30.40 and server IP as 192.168.2.6
Now, client is able to ping VIP but not able to establish tcp on Port 35390 debug flow logs are:
*id=13 trace_id=1011 func=print_pkt_detail line=4307 msg="vd-root received a packet(proto=6, 10.20.30.4:46663->192.168.2.6:35390) from INTERNET-INTERFACE. flag [S], seq 186011604, ack 0, win 8192" id=13 trace_id=1011 func=init_ip_session_common line=4463 msg="allocate a new session-36c86cf8" id=13 trace_id=1011 func=vf_ip4_route_input line=1605 msg="find a route: flags=00000000 gw-192.168.2.6 via SERVER-INTERFACE" id=13 trace_id=1011 func=__iprope_tree_check line=534 msg="use addr/intf hash, len=3" id=13 trace_id=1011 func=fw_forward_handler line=537 msg="**Denied by forward policy check (policy 0)**"*
However policy is there in FG2; and through this policy only ping is working (checked the same in logs)
Unable to understand where the issue is. Please guide.