Skip to main content
TJNIHAL
New Member
March 11, 2016
Solved

IPsec tunnel failing frequently..

  • March 11, 2016
  • 4 replies
  • 17587 views

Hello, Having issues keeping a IPsec Site-to-Site tunnel up..

 

I am having FG60D device successfully connect to azure using FortiGate Cookbook - IPsec VPN to Microsoft Azure (5.2)  

 

but tunnel got disconnect frequently in few hours and Had to reboot 60D always to get the tunnel bring up

 

firmware version : V5.2.6, build711

 

phase 1 proposal :

 

encryption AES 128 authentication SHA256

encryption AES 256 authentication SHA256

encryption AES 128 authentication SHA1

encryption AES 256 authentication SHA1

Diffie-Hellman group       : 2

key lifetime                    : 56600 seconds

 

 

phase 2 proposal :

 

encryption AES 128 authentication SMA1

encryption AES 256 authentication SHA1

encryption AES 128 authentication SHA256

encryption AES 256 authentication SHA256

 

Replay detection [enabled]

PFS                    [enabled]

Diffie-Hellman group    : 2

Local Port            [enabled]

Remote port        [enabled]

Protocol              [enabled]

Autokey keep Alive  [enabled]

Auto-negotiate        [enabled]

key lifetime             : 7200 seconds

 

It seems known problem in 60D

 

Any help is highly appreciated,

 

Thanks!

Nihal

    Best answer by ede_pfau

    This problem is related to key lifetime differences, not hardware or firmware version.

    From what I've read what other vendors recommend the following IPsec parameters are needed:

     

    phase1

    IKEv1

    PSK

    DH group 2

    encryption AES256 or AES128 or 3DES

    hash SHA1

    key lifetime: 28800 sec

     

    phase2

    encryption AES256 or AES128 or 3DES

    hash SHA1

    no PFS

    no Dead Peer Detection

    key lifetime 3600 sec

     

    I would enable auto key renegotiation for both phase1 and phase2.

     

    Especially the key lifetimes given in the Cookbook article and video are odd (56600 and 56660). I can only assume they were meant to be 2 * 28800 = 57600. All other vendors follow Microsoft's parameters, 28800 and 3600 seconds so I would try that first.

    4 replies

    ede_pfau
    SuperUser
    ede_pfauAnswer
    SuperUser
    March 11, 2016

    This problem is related to key lifetime differences, not hardware or firmware version.

    From what I've read what other vendors recommend the following IPsec parameters are needed:

     

    phase1

    IKEv1

    PSK

    DH group 2

    encryption AES256 or AES128 or 3DES

    hash SHA1

    key lifetime: 28800 sec

     

    phase2

    encryption AES256 or AES128 or 3DES

    hash SHA1

    no PFS

    no Dead Peer Detection

    key lifetime 3600 sec

     

    I would enable auto key renegotiation for both phase1 and phase2.

     

    Especially the key lifetimes given in the Cookbook article and video are odd (56600 and 56660). I can only assume they were meant to be 2 * 28800 = 57600. All other vendors follow Microsoft's parameters, 28800 and 3600 seconds so I would try that first.

    TJNIHAL
    TJNIHALAuthor
    New Member
    March 14, 2016

    Hello Ede,

     

    thanks for your replay

     

    I will change the configuration as per your suggestion and comeback with result soon.

     

     

     

    Thanks,

    Nihal

    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.