Problem (LOG) with Fortigate 200E

Question

Hi guys,

i already had S2S ipsec to a company that it was working , now i deleted these ipsec because we don't want to work together but i have still this log. why ?

02-10-2020 11:43:20 User.Error date=2020-02-10 time=11:43:20 devname="Fortigate 200E" devid="FG200ETK189120" logid="01010324" type="event" subtype="vpn" level="error" vd="root" eventtime=15813300 logdesc="IPsec phase 1 error" msg="IPsec phase 1 error" action="negotiate" remip=****** locip=****** remport=522 locport=522 outintf="wan1" cookies="c38065091/0000000000000" user="N/A" group="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="N/A" status="negotiate_error" reason="peer SA proposal not match local policy" peer_notif="NOT-APPLICABLE"

-------------------------------------------------------------------------------------------------------------------------------

02-11-2020 09:16:18 User.Error date=2020-02-11 time=09:16:17 devname="Fortigate 200E"

devid="FG200ET20" logid="010108" type="event" subtype="vpn" level="error" vd="root" eventtime=15814077 logdesc="Progress IPsec phase 1" msg="progress IPsec phase 1" action="negotiate" remip=******* locip=****** remport=522 locport=522 outintf="wan1" cookies="018d8587b/0000000" user="N/A" group="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="N/A" status="failure" init="remote" mode="main" dir="inbound" stage=1 role="responder" result="ERROR"

Best Regard

ede_pfau · Answer

It basically says there is an IPsec VPN connection attempt but the policy is missing. Most probably the other side still has it's VPN configuration in place and tries to reconnect. You can verify this by looking at the remote IP.

If it's not the other site, it's some rogue connection attempt. These are quite frequent and common nowadays. If it bothers you, you can write a local-in policy to block this host.

Sign up

Login with SSO

Login to the community

Login with SSO