Fortigate FG30E IPSec Fail to Connect with "ignoring IKEv2 request, no policy configured"
I've search all over the place and try everything I could to find where am I doing wrong. I hope you can help me to check where the problem is.
So I have fortigate FG30E, let's called Site1 (IP 1.1.1.1). And there is another fortigate called Site2 (IP 2.2.2.2, the firewall which I cannot control) that I tried to connect to.
I created a VPN Tunnel called "MY_VPN" to connect VPN Ipsec to Site2. But it just won't connect (cannot be brought up). On the log (diag debug app ike -1 , diag debug enable ) it said "ignoring IKEv2 request, no policy configured" which I've clearly created on "Policy & Objects" -> "Security Policy" (there is no "Ipv4 Policy" menu on my Fortigate).
I also has create static route. And to ensure disable the NAT on the Security Policy, I've created extra policy on "Policy & Objects > Central SNAT". Still unable to connect. I hope you can help me find out what the problem here.
Any help will be much appreciated
============================
config firewall security-policy ... edit 33 set uuid eabc671a-a6fc-51eb-306a-97212015e312 set name "SITE1_TO_SITE2" set srcintf "lan4" set dstintf "MY_VPN" set srcaddr4 "all" set dstaddr4 "all" set enforce-default-app-port disable set service "ALL" set action accept set schedule "always" set logtraffic all next edit 34 set uuid 4870034e-a6fd-51eb-4d1d-82bb53e942f1 set name "SITE2_TO_SITE1" set srcintf "MY_VPN" set dstintf "lan4" set srcaddr4 "all" set dstaddr4 "all" set enforce-default-app-port disable set service "ALL" set action accept set schedule "always" set logtraffic all next end =============================================== # show router static config router static ... edit 12 set dst 172.18.3.0 255.255.255.0 set device "MY_VPN" next end ============================================================= # show firewall central-snat-map config firewall central-snat-map edit 19 set orig-addr "all" set srcintf "lan4" set dst-addr "all" set dstintf "MY_VPN" set nat disable next edit 20 set orig-addr "all" set srcintf "MY_VPN" set dst-addr "all" set dstintf "lan4" set nat disable next ===================================================================== # show vpn ipsec phase1-interface MY_VPN config vpn ipsec phase1-interface edit "MY_VPN" set interface "CBN.iNET" set ike-version 2 set peertype any set net-device disable set proposal aes128-sha1 set dhgrp 21 set nattraversal disable set remote-gw 2.2.2.2 set psksecret ENC zkNe14wSA+nu5PUKnRxvGVSIJ77GcIANcIrvwplaGdznVkeCtKjSHe4gqySkSLWHCDgzM/KnqfmNFqVcaCNsLs1rAT80mrnmULIPSdDj1GxW9Ocg1qjrhtklq/H1Hg6he2pv36OjAyVx/2I4xHci0VXrbOmBPMzz4llxOiXvNQsrflkZl/779ZNxXX8xry/NHvQBAQ== next end # show vpn ipsec phase2-interface TEST config vpn ipsec phase2-interface edit "TEST" set phase1name "MY_VPN" set proposal aes128-sha1 set dhgrp 21 set auto-negotiate enable set keylifeseconds 86400 set src-subnet 10.100.79.0 255.255.255.0 set dst-subnet 172.18.3.0 255.255.255.0 next end ======================= # diag debug enable ike 0: comes 2.2.2.2:500->1.1.1.1:500,ifindex=12.... ike 0: IKEv2 exchange=SA_INIT id=16c8b2b2cc27e688/0000000000000000 len=412 ike 0: in 16C8B2B2CC27E688000000000000000021202208000000000000019C220000C80200002C010100040300000C0100000C800E00800300000802000005030000080300000C00000008040000150200002C020100040300000C0100000C800E01000300000802000005030000080300000C000000080400001502000024030100030300000C01000014800E00800300000802000005000000080400001502000024040100030300000C01000014800E01000300000802000006000000080400001500000024050100030300000C0100001C800E0100030000080200000500000008040000152800008C0015000001914E8583A6A189283121D4FDD107E1CD44679BC871BCED24624D5D80768FE0CB9839021F2C9F97FB2F28F08BCEEBC5D545C2D920686139709B99A8C7A52C1FC9B9002D5DBD5F65CAA8FF1C4788AF167BE92D6D447B20E7503F0EA48FA05EE0481B6795B602FB1E311E1F72B668F781C0297C9E17C5AA747DE0250283F1CAD19819527329000024F52B6DDED4E8063AE2EEBD2D5C0711D810F1FE1E05B7358A4DF77A686B9FB931000000080000402E ike 0:16c8b2b2cc27e688/0000000000000000:70668: responder received SA_INIT msg ike 0:16c8b2b2cc27e688/0000000000000000:70668: received notify type FRAGMENTATION_SUPPORTED ike 0:16c8b2b2cc27e688/0000000000000000:70668: incoming proposal: ike 0:16c8b2b2cc27e688/0000000000000000:70668: proposal id = 1: ike 0:16c8b2b2cc27e688/0000000000000000:70668: protocol = IKEv2: ike 0:16c8b2b2cc27e688/0000000000000000:70668: encapsulation = IKEv2/none ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=ENCR, val=AES_CBC (key_len = 128) ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=INTEGR, val=AUTH_HMAC_SHA2_256_128 ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=PRF, val=PRF_HMAC_SHA2_256 ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=DH_GROUP, val=ECP521. ike 0:16c8b2b2cc27e688/0000000000000000:70668: proposal id = 2: ike 0:16c8b2b2cc27e688/0000000000000000:70668: protocol = IKEv2: ike 0:16c8b2b2cc27e688/0000000000000000:70668: encapsulation = IKEv2/none ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=ENCR, val=AES_CBC (key_len = 256) ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=INTEGR, val=AUTH_HMAC_SHA2_256_128 ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=PRF, val=PRF_HMAC_SHA2_256 ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=DH_GROUP, val=ECP521. ike 0:16c8b2b2cc27e688/0000000000000000:70668: proposal id = 3: ike 0:16c8b2b2cc27e688/0000000000000000:70668: protocol = IKEv2: ike 0:16c8b2b2cc27e688/0000000000000000:70668: encapsulation = IKEv2/none ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=ENCR, val=AES_GCM_16 (key_len = 128) ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=PRF, val=PRF_HMAC_SHA2_256 ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=DH_GROUP, val=ECP521. ike 0:16c8b2b2cc27e688/0000000000000000:70668: proposal id = 4: ike 0:16c8b2b2cc27e688/0000000000000000:70668: protocol = IKEv2: ike 0:16c8b2b2cc27e688/0000000000000000:70668: encapsulation = IKEv2/none ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=ENCR, val=AES_GCM_16 (key_len = 256) ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=PRF, val=PRF_HMAC_SHA2_384 ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=DH_GROUP, val=ECP521. ike 0:16c8b2b2cc27e688/0000000000000000:70668: proposal id = 5: ike 0:16c8b2b2cc27e688/0000000000000000:70668: protocol = IKEv2: ike 0:16c8b2b2cc27e688/0000000000000000:70668: encapsulation = IKEv2/none ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=ENCR, val=CHACHA20_POLY1305 (key_len = 256) ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=PRF, val=PRF_HMAC_SHA2_256 ike 0:16c8b2b2cc27e688/0000000000000000:70668: type=DH_GROUP, val=ECP521. ike 0:MY_VPN: ignoring IKEv2 request, no policy configured ike 0:16c8b2b2cc27e688/0000000000000000:70668: negotiation failure ike Negotiate SA Error: ike ike [10217]
