IPsec tunnel is established but internal resources are unreachable

1. Review the Phase 2 configuration and confirm that it includes the VPN client or remote subnet and the intended internal destination subnet.
2. Verify that the FortiGate has an active route for the internal destination through the appropriate IPsec tunnel.
3. Check that a firewall policy permits traffic from the IPsec tunnel to the internal network and that its source and destination address objects match the expected traffic.
4. Confirm that the internal network has a route back to the VPN client or remote subnet. An incorrect return path can prevent communication even when the tunnel is UP.
5. Review the Active Directory user-group connection and correct its configuration or association. This was the resolution in the reported case.
6. If the issue remains, trace one specific connection from a VPN client to one internal IP address to determine where the traffic is dropped.

Confirm that the IPsec tunnel remains established, then test access from a VPN client to a specific internal IP address. Successful bidirectional communication verifies the selectors, route, firewall policy, return path, and user-group handling.