Skip to main content
rbrahmi
rbrahmi
New Member
October 23, 2020
Question

IPsec VPN tunnel down

  • October 23, 2020
  • 2 replies
  • 6614 views

Hello,

 

I am trying to set up a VPN tunnel between a fortigate and palo alto firewall on the remote site, the fortigate is connected behind a juniper which is used to net the private address on the exterior interface of the fortigate and then we have a peplik which overcomes the public addresses with port redirects All VPN tunnels are connected except one tunnel Below are the logs generated by fortigate when I debug

 

ike 0:BKAM-DC:784401: out C2FE6E0C9FC42BEA00000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:BKAM-DC:784401: sent IKE msg (P1_RETRANSMIT): 192.168.10.2:500->105.73.83.17:500, len=288, id=c2fe6e0c9fc42bea/0000000000000000 ike 0:BKAM-DC:784401: negotiation timeout, deleting ike 0:BKAM-DC: connection expiring due to phase1 down ike 0:BKAM-DC: deleting ike 0:BKAM-DC: deleted ike 0:BKAM-DC: schedule auto-negotiate ike 0:BKAM-DC:784403: initiator: main mode is sending 1st message... ike 0:BKAM-DC:784403: cookie d03c7f08585f989f/0000000000000000 ike 0:BKAM-DC:784403: out D03C7F08585F989F00000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:BKAM-DC:784403: sent IKE msg (ident_i1send): 192.168.10.2:500->105.73.83.17:500, len=288, id=d03c7f08585f989f/0000000000000000 ike 0:BKAM-DC:784403: out D03C7F08585F989F00000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:BKAM-DC:784403: sent IKE msg (P1_RETRANSMIT): 192.168.10.2:500->105.73.83.17:500, len=288, id=d03c7f08585f989f/0000000000000000 ike shrank heap by 159744 bytes ike 0:BKAM-DC:784403: out D03C7F08585F989F00000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:BKAM-DC:784403: sent IKE msg (P1_RETRANSMIT): 192.168.10.2:500->105.73.83.17:500, len=288, id=d03c7f08585f989f/0000000000000000 ike 0:BKAM-DC:784403: out D03C7F08585F989F00000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:BKAM-DC:784403: sent IKE msg (P1_RETRANSMIT): 192.168.10.2:500->105.73.83.17:500, len=288, id=d03c7f08585f989f/0000000000000000 ike 0:BKAM-DC:784403: negotiation timeout, deleting ike 0:BKAM-DC: connection expiring due to phase1 down ike 0:BKAM-DC: deleting ike 0:BKAM-DC: deleted ike 0:BKAM-DC: schedule auto-negotiate ike 0:BKAM-DC:784405: initiator: main mode is sending 1st message... ike 0:BKAM-DC:784405: cookie 8001bc2bad1fee27/0000000000000000 ike 0:BKAM-DC:784405: out 8001BC2BAD1FEE2700000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:BKAM-DC:784405: sent IKE msg (ident_i1send): 192.168.10.2:500->105.73.83.17:500, len=288, id=8001bc2bad1fee27/0000000000000000 ike 0:BKAM-DC:784405: out 8001BC2BAD1FEE2700000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:BKAM-DC:784405: sent IKE msg (P1_RETRANSMIT): 192.168.10.2:500->105.73.83.17:500, len=288, id=8001bc2bad1fee27/0000000000000000 diag2020-10-23 12:05:38.934056 ike shrank heap by 159744 bytes

 

Any help please

 

Ragrds

    2 replies

    mauromosc
    mauromosc
    New Member
    October 23, 2020

    Hi, Radouane,

     

    Stupid question, but I have to ask you: did you enable NAT-T? Is this Juniper a router or a firewall? Does it have a rule allowing this traffic or is it NATing it? 

    From the logs you can see that there is no response from the other peer, it would interesting to you debug the Palo Alto to see if it receives any thing from your FortiGate.

     

    Good luck,

    Mauro.

    rbrahmi
    rbrahmiAuthor
    New Member
    October 23, 2020

    Hi,

     

    Can you tell me why this is a stupid question please?

    Isn't this a forum for discussing issues like mine ?

    If you think this is a stupid question, don't answer please

     

    Regards

    mauromosc
    mauromosc
    New Member
    October 23, 2020

    Hi, Radouane,

     

    I'm sorry, I wasn't clear about my text. My question was stupid. :)  Also count to 10 before texting and read again:

     

    Stupid question, but I have to ask you

     

    And your concern is completely valid and add value to the discussions here.

     

    Regards,

    Mauro Mosczynski

    mendocino
    mendocino
    New Member
    November 4, 2020

    Hello, how are you? You were able to solve the problem, since I have a similar problem

    Terms & ConditionsAccessibility statement