Solution | By default, the FortiGate IPsec negotiation has a 30-second timeout. This means the FortiGate will wait for a response from the peer for no longer than 30 seconds.
In the output below, it can be seen that the FortiGate sent ident_i1send, but did not receive a response from the peer within the 30-second window, resulting in a connection timeout.
diagnose debug reset
diagnose debug app ike -1
diagnose debug enable
diagnose debug console timestamp enable
 To stop debugging:
diagnose debug disable
diagnose debug reset
 2025-01-09 12:34:28.120523 ike V=root:0:TEST: auto-negotiate connection
2025-01-09 12:34:28.122556 ike V=root:0:TEST:TEST: created connection: 0xff4a6b0 3 10.47.1.77->10.47.3.146:500.
2025-01-09 12:34:28.125303 ike V=root:0:TEST:16: initiator: main mode is sending 1st message...
2025-01-09 12:34:28.127912 ike V=root:0:TEST:16: cookie cf5294e1886d4c3a/0000000000000000
2025-01-09 12:34:28.130501 ike 0:TEST:16: out CF5294E1886D4C3A000000000000000001
100200000000000000023
C0D000154000000010000000100000148010100080300002801010000800B0001000C000400015180
80010007800E00808003
0001800200048004000E0300002802010000800B0001000C00040001518080010007800E008080030
00180020004800400050
300002803010000800B0001000C00040001518080010007800E010080030001800200048004000E03
00002804010000800B00
01000C00040001518080010007800E01008003000180020004800400050300002805010000800B000
1000C000400015180800
10007800E008080030001800200028004000E0300002806010000800B0001000C0004000151808001
0007800E008080030001
80020002800400050300002807010000800B0001000C00040001518080010007800E0100800300018
00200028004000E00000
02808010000800B0001000C00040001518080010007800E01008003000180020002800400050D0000
144A131C81070358455C
5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CF
DB2FC68B6A4480D00001
490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D000014
4485152D18B6BBCD0BE8
A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7D
E7F00D6C2D30D0000184
048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000
2025-01-09 12:34:28.155479 ike V=root:0:TEST:16: sent IKE msg (ident_i1send): 10.47.1.77:500->10.47.3.146:500, len=572, vrf=0, id=cf5294e1886d4c3a/0000000000000000
2025-01-09 12:34:31.127102 ike 0:TEST:16: out CF5294E1886D4C3A0000000000000000011
00200000000000000023
C0D0001540000000100000001000001480101000803000
02801010000800B0001000C00040001518080010007800E008080030001800200048004000E030000
2802010000800B000100
0C00040001518080010007800E00808003000180020004800400050300002803010000800B0001000
C0004000151808001000
7800E010080030001800200048004000E0300002804010000800B0001000C00040001518080010007
800E0100800300018002
0004800400050300002805010000800B0001000C00040001518080010007800E00808003000180020
0028004000E030000280
6010000800B0001000C00040001518080010007800E00808003000180020002800400050300002807
010000800B0001000C00
040001518080010007800E010080030001800200028004000E0000002808010000800B0001000C000
40001518080010007800
E01008003000180020002800400050D0000144A131C81070358455C5728F20E95452F0D0000147D94
19A65310CA6F2C179D92
15529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5E
C427B1F0D00001416F6C
A16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD7
1368A1F1C96B8696FC77
5701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D
6C2D3C00000000000001
48299031757A36082C6A621DE00000000
2025-01-09 12:34:31.145221 ike V=root:0:TEST:16: sent IKE msg (P1_RETRANSMIT): 10.47.1.77:500->10.47.3.146:500, len=572, vrf=0, id=cf5294e1886d4c3a/0000000000000000
2025-01-09 12:34:37.125672 ike 0:TEST:16: out CF5294E1886D4C3A00000000000000000110
0200000000000000023C
0D00015400000001000000010000014801010008030000
2801010000800B0001000C00040001518080010007800E008080030001800200048004000E03000028
02010000800B0001000C
00040001518080010007800E00808003000180020004800400050300002803010000800B0001000C00
04000151808001000780
0E010080030001800200048004000E0300002804010000800B0001000C00040001518080010007800E
01008003000180020004
800400050300002805010000800B0001000C00040001518080010007800E0080800300018002000280
04000E03000028060100
00800B0001000C00040001518080010007800E00808003000180020002800400050300002807010000
800B0001000C00040001
518080010007800E010080030001800200028004000E0000002808010000800B0001000C0004000151
8080010007800E010080
03000180020002800400050D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310
CA6F2C179D9215529D56
0D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D
00001416F6CA16E4A406
6D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C9
6B8696FC775701000D00
00144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C00000
00000000148299031757
A36082C6A621DE00000000
2025-01-09 12:34:37.151208 ike V=root:0:TEST:16: sent IKE msg (P1_RETRANSMIT): 10.47.1.77:500->10.47.3.146:500, len=572, vrf=0, id=cf5294e1886d4c3a/0000000000000000
2025-01-09 12:34:49.118769 ike 0:TEST:16: out CF5294E1886D4C3A00000000000000000110
0200000000000000023C0
D00015400000001000000010000014801010008030000
2801010000800B0001000C00040001518080010007800E008080030001800200048004000E030000280
2010000800B0001000C0
0040001518080010007800E00808003000180020004800400050300002803010000800B0001000C0004
0001518080010007800E
010080030001800200048004000E0300002804010000800B0001000C00040001518080010007800E010
08003000180020004800
400050300002805010000800B0001000C00040001518080010007800E00808003000180020002800400
0E030000280601000080
0B0001000C00040001518080010007800E00808003000180020002800400050300002807010000800B0
001000C0004000151808
0010007800E010080030001800200028004000E0000002808010000800B0001000C0004000151808001
0007800E010080030001
80020002800400050D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C1
79D9215529D560D00001
4CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416
F6CA16E4A4066D83821A
0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC7
75701000D0000144048B
7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C000000000000014
8299031757A36082C6A6
21DE00000000
2025-01-09 12:34:49.146385 ike V=root:0:TEST:16: sent IKE msg (P1_RETRANSMIT): 10.47.1.77:500->10.47.3.146:500, len=572, vrf=0, id=cf5294e1886d4c3a/0000000000000000
2025-01-09 12:34:58.122471 ike V=root:0:TEST:16: negotiation timeout, deleting
2025-01-09 12:34:58.123722 ike V=root:0:TEST: connection expiring due to phase1 down
2025-01-09 12:34:58.124912 ike V=root:0:TEST: going to be deleted
 This negotiation timeout timer can be adjusted only through the CLI, where the default value is 30:  config vpn ipsec phase1-interface
  edit x
    set negotiate-timeout Enter an integer value from <1> to <300>
end
 Notes: When using two-factor authentication for a dial-up tunnel, it is recommended to extend this timer to give remote users more time to enter a one-time password (OTP). High tunnel setup rate: Helps when the FortiOS IKE daemon (iked) is busy handling a large number of tunnel establishments, such as on a dial-up VPN server. High latency or packet loss: Allows additional time for IKE messages to be exchanged when the connection has high latency or requires retransmissions due to poor line quality or packet loss. On FortiClient v7.4.4, errors like 'Child SA Negotiation Failed' will show. This command applies to both IKEv1 and IKEv2. Sometimes this issue also requires updating the PSK to restore the service.
However, negotiate-timeout does not override the IKE retransmission mechanism. If no response is received for an IKE request and the retransmission logic reaches its maximum (5 retransmission attempts over approximately 93 seconds), the IKE SA negotiation is aborted, regardless of how much time remains in the configured negotiate-timeout period.
Increasing negotiate-timeout is useful when the negotiation is progressing slowly, but it cannot keep a negotiation alive after the IKE retransmission process has already been exhausted.
 Related article:
Technical Tip: Hard timeout for Dialup IPsec VPN Tunnel |
