Technical Tip: Unable to get IPsec VPN established after using SPA easy configuration key

Description

This article describes a solution for a situation where, following the SPA easy configuration key for FortiSASE on FortiOS v7.6.5+, the IPsec with FortiSASE remains down.

Scope

 FortiGate v7.6.5+, FortiSASE.

Solution

The reason why the VPN is unable to activate is a mismatch between FortiOS and FortiSASE default DH group preset.

Where FortiOS v7.6.5 started using DH groups 20 and 21 as mentioned in the Changes in default behavior by default, FortiSASE still uses DH groups 14 and 5 as documented in SPA Deployment Guide using BGP per Overlay IPsec configuration section.

To solve the situation, the FortiOS VPN configuration needs to include DH group 14 (a more secure option) or 5 (considered cryptographically weak):

config vpn ipsec phase1-interface
    edit "fabric_vpn_1"
        append dhgrp 14
    next
end
config vpn ipsec phase2-interface
    edit "fabric_vpn_1"
        append dhgrp 14
    next
end

Related documents:

Verifying and troubleshooting IPsec connection

Troubleshooting Tip: FortiSASE SPA Troubleshooting Triage

Troubleshooting Tip: IPsec VPN tunnels

Troubleshooting Tip: IPSec VPN down due to 'mismatched DH group in KE payload'