New Member

Question

help to VPN between FGT & cisco

Forum|Forum|2 years ago
May 27, 2024
5 replies
4456 views

I set VPN between FGT v6.4 & Cisco2911

on FW display phase1 done but phase2 down

so when I check event VPN, result is phase 1 error

On cisco, status is UP-IDLE

for some reason, I had to hide the information

look forward to the help

RT config.png show crypto RT.png VPN event.png diag FW.png

fricci_FTNT

Staff

Hi @quynhln8 ,

I can see that in the phase2 you have configured lifetime 3600 on the ForiGate side but on the Cisco I do not see it (default should be 28800 if I remember correctly).

You can run the following debug to find out why the phase2 is not coming up:

diagnose vpn ike log-filter dst-addr4 <remote-peer-IP>
diagnose debug application ike -1
diagnose debug console timestamp enable
diagnose debug enable

Note: Starting from FortiOS 7.4.1, the 'diagnose vpn ike log-filter dst-addr4' command has been changed to 'diagnose vpn ike log filter rem-addr4'.

The following articles might help:
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Troubleshooting-IPsec-Site-to-Site-Tunnel/ta-p/195672

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-VPNs-tunnels/ta-p/195955

Best regards,

quynhln8Author

New Member

in Cisco RT, I show crypto map, life-time is 3600

fricci_FTNT

Staff

Hi @quynhln8 ,

Thank you for confirming it.
Please run the debug I suggested you in my previous message, it should highlight if there is any mismatch in the IPsec config.

Best regards,

quynhln8Author

New Member

This is debug follow your guide, do you see any error anywhere
I dont know how to insert .txt file
https://drive.google.com/file/d/1DqA6JIPThL791e4tUiP1HkQFMTJ-ZvWt/view?usp=drive_link

fricci_FTNT

Staff

Hi @quynhln8 ,

It looks like that the Cisco is not choosing a proposals for some reason, then it sends a notification to the FGT and the FGT deletes the corresponding phase 2 Security Parameter Index. Phase 2 negotiation then restarts again:

2024-05-29 17:19:20.066987 ike 0:ABCDEFGH:159258: notify msg received: NO-PROPOSAL-CHOSEN
2024-05-29 17:19:20.067013 ike 0:ABCDEFGH:159258:ABCDEFGH:2762615: IPsec SPI 52416064 match
2024-05-29 17:19:20.067019 ike 0:ABCDEFGH:159258:ABCDEFGH:2762615: delete phase2 SPI 52416064

Please try to choose a different proposal and check if the anti-reply is also enabled on the Cisco side (if available).
https://community.fortinet.com/t5/FortiGate/Technical-Note-Explaining-IPSEC-Anti-replay-and-preventing/ta-p/192424
Once done, please launch the debug commands again and then reset the IPsec tunnel on both ends, so you can see the whole phase1/phase2 negotiation outputs in the debug (you can use "diagnose debug application ike 255" instead of -1).

Also on phase2 config on the FortiGate side you configured 172.16.0.0/16 and on the Cisco side you configured 172.16.40.0/24 and 172.16.44.0/24.

Can you try to configure two separate phase2 selectors on the FortiGate side as well, please.

You may find the below old post useful:
https://community.fortinet.com/t5/Support-Forum/Site-to-site-VPN-Fortigate-5-4-and-Cisco-NO-PROPOSAL-CHOSEN/m-p/33192

Best regards,

achu

Staff

Hi @quynhln8 ,

Based on the description, you see phase 1 is up but phase 2 is down on FortiGate?

Did you try disabling PFS on FortiGate and flush the tunnel?

quynhln8Author

New Member

The thing is FGT display phase1 up, phase2 down, but when show VPN event, phase2 success, phase1 error. This problem is very confusing

fricci_FTNT

Staff

Hi @quynhln8 ,

Have you run the command below as previously suggested? Have you spotted any mismatch?

diagnose vpn ike log-filter dst-addr4 <remote-peer-IP>
diagnose debug application ike -1
diagnose debug console timestamp enable
diagnose debug enable

Note: Starting from FortiOS 7.4.1, the 'diagnose vpn ike log-filter dst-addr4' command has been changed to 'diagnose vpn ike log filter rem-addr4'.

If you can, please paste its output here. If you cannot paste it, I would suggest you to open a ticket with our support so this issue can be properly investigated.

Best regards,