Admin has configured multiples vpns in the same interface. It is expected to connect to the VPN FCLi_TI-Alg, where VPN negotiation is increased to 300 seconds. VPN FCLI_TerceirAlg has a default timeout of 30 seconds.
config vpn ipsec phase1-interface
edit "FCLi_TI-Alg"
set type dynamic
set interface "a"
set ike-version 2
set peertype one
set net-device disable
set mode-cfg enable
set proposal aes128-sha256 aes256-sha256
set localid "VPN_TI"
set negotiate-timeout 300
set dhgrp 20 21
set eap enable
set eap-identity send-request
set authusrgrp "VPN_TI"
set nattraversal forced
set fragmentation-mtu 1350
set transport udp
set peerid "VPN_TI"
next
edit "FCLI_TerceirAlg"
set type dynamic
set interface "a"
set ike-version 2
set peertype any
set net-device disable
set mode-cfg enable
set proposal aes256-sha384 aes256-sha256
set localid "Terceiros"
set comments "VPN: FCLI_TerceirAlg -- Created by VPN wizard"
set dhgrp 20 21
set eap enable
set eap-identity send-request
set wizard-type dialup-forticlient
set authusrgrp "VPN_Terceiros"
set nattraversal forced
set transport auto
next
end
In the IKE debug, it is possible to observe incorrect VPN FCLI_TerceirAlg has been chosen:
2026-06-16 08:54:36.361262 ike V=root:0: comes 149.19.165.135:55322->201.48.36.129:4500,ifindex=11,vrf=0,len=474....
2026-06-16 08:54:36.361306 ike V=root:0: IKEv2 exchange=SA_INIT id=08f334aca8227016/0000000000000000 len=470
2026-06-16 08:54:36.361319 ike 0: in
2026-06-16 08:54:36.361354 ike V=root:0:08f334aca8227016/0000000000000000:911700: responder received SA_INIT msg
...
2026-06-16 08:54:36.361590 ike V=root:0:08f334aca8227016/0000000000000000:911700: type=DH_GROUP, val=ECP384.
2026-06-16 08:54:36.361607 ike V=root:0:08f334aca8227016/0000000000000000:911700: matched proposal id 2
2026-06-16 08:54:36.361615 ike V=root:0:08f334aca8227016/0000000000000000:911700: proposal id = 2:
2026-06-16 08:54:36.361620 ike V=root:0:08f334aca8227016/0000000000000000:911700: protocol = IKEv2:
2026-06-16 08:54:36.361626 ike V=root:0:08f334aca8227016/0000000000000000:911700: encapsulation = IKEv2/none
2026-06-16 08:54:36.361631 ike V=root:0:08f334aca8227016/0000000000000000:911700: type=ENCR, val=AES_CBC (key_len = 256)
2026-06-16 08:54:36.361637 ike V=root:0:08f334aca8227016/0000000000000000:911700: type=INTEGR, val=AUTH_HMAC_SHA2_256_128
2026-06-16 08:54:36.361642 ike V=root:0:08f334aca8227016/0000000000000000:911700: type=PRF, val=PRF_HMAC_SHA2_256
2026-06-16 08:54:36.361648 ike V=root:0:08f334aca8227016/0000000000000000:911700: type=DH_GROUP, val=ECP384.
2026-06-16 08:54:36.361653 ike V=root:0:08f334aca8227016/0000000000000000:911700: lifetime=86400
2026-06-16 08:54:36.361662 ike V=root:0:08f334aca8227016/0000000000000000:911700: SA proposal chosen, matched gateway FCLI_TerceirAlg
Later in the debug, the admin can see a switch to correct the VPN, change phase1 profile to FCLi_TI-Alg.
026-06-16 08:54:36.474893 ike V=root:0:FCLI_TerceirAlg:911700: reassembled fragmented message
2026-06-16 08:54:36.474899 ike V=root:0:FCLI_TerceirAlg:911700: responder received AUTH msg
2026-06-16 08:54:36.474907 ike V=root:0:FCLI_TerceirAlg:911700: processing notify type INITIAL_CONTACT
2026-06-16 08:54:36.474934 ike V=root:0:FCLI_TerceirAlg:911700: received peer identifier FQDN 'VPN_TI'
2026-06-16 08:54:36.474943 ike V=root:0:FCLI_TerceirAlg:911700: re-validate gw ID
2026-06-16 08:54:36.474958 ike V=root:0:FCLI_TerceirAlg: change phase1 profile to FCLi_TI-Alg<---
2026-06-16 08:54:36.474966 ike V=root:0:FCLi_TI-Alg:911700: gw validation OK
But as the VPN timeout was negotiated with the incorrect VPN, after 30 seconds, the admin will see the message 'Negotiate SA Error: ike negotiation timeout'.
2026-06-16 08:54:45.073916 ike V=root:0:FCLi_TI-Alg:911700: sent IKE msg (AUTH_RESPONSE): 201.48.36.129:4500->149.19.165.135:55322, len=96, vrf=0, id=08f334aca8227016/9dd5823f056b9929:0000000b, oif=11
2026-06-16 08:55:06.368009 ike V=root:0:FCLi_TI-Alg:911700: negotiation timeout, deleting
2026-06-16 08:55:06.368063 ike V=root:FCLi_TI-Alg Negotiate SA Error: ike negotiation timeout
2026-06-16 08:55:06.368163 ike V=root:0:FCLi_TI-Alg: connection expiring due to phase1 down
2026-06-16 08:55:06.368180 ike V=root:0:FCLi_TI-Alg: going to be deleted
2026-06-16 08:55:06 [2425] handle_req-Rcvd abort req for 9071147061474
2026-06-16 08:55:06 [597] destroy_auth_session-delete session 9071147061474
To fix the issue, define a neTwork-id for each VPN.
config vpn ipsec phase1-interface
edit <example>
set ike-version 2
set network-overlay enable
set network-id <integer>
next
end
In order to view the output of the IKE debug and troubleshoot IKE negotiation on the FortiGate, the following commands need to be run:
diagnose debug application ike -1
diagnose debug console timestamp enable
diagnose debug enable
To disable the debug:
diagnose debug disable
diagnose debug reset
| 
