Skip to main content
Xander
Xander
New Member
March 27, 2017
Solved

Site to site VPN Fortigate 5.4 and Cisco- NO-PROPOSAL-CHOSEN

  • March 27, 2017
  • 1 reply
  • 62866 views

Hello,

 

In our company we have Fortigate 60D (v5.4.1) and I'm trying to setup the VPN with Cisco router. Cisco router is owned by other company and I do not have access to it. Phase 1 seems to work as expected ([...] - text cut for better visibility):

ike 0:phase-1-int:193473: negotiation result
ike 0:phase-1-int:193473: proposal id = 1:
ike 0:phase-1-int:193473: protocol id = ISAKMP:
ike 0:phase-1-int:193473: trans_id = KEY_IKE.
ike 0:phase-1-int:193473: encapsulation = IKE/none
ike 0:phase-1-int:193473: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=256
ike 0:phase-1-int:193473: type=OAKLEY_HASH_ALG, val=SHA2_512.
ike 0:phase-1-int:193473: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:phase-1-int:193473: type=OAKLEY_GROUP, val=ECP384.
ike 0:phase-1-int:193473: ISAKMP SA lifetime=28800
[...]
ike 0:phase-1-int:193473: VID CISCO-UNITY [...]
ike 0:phase-1-int:193473: peer supports UNITY
[...]
ike 0:phase-1-int:193473: DPD negotiated
ike 0:phase-1-int:193473: NAT not detected
ike 0:phase-1-int:193473: PSK authentication succeeded
ike 0:phase-1-int:193473: authentication OK
ike 0:phase-1-int:193473: established IKE SA [...]

 

But then I get the error as follows

 

ike 0:phase-1-int:193473: notify msg received: NO-PROPOSAL-CHOSEN
ike 0:phase-1-int:193473:phase-2-int:4954165: IPsec SPI d888eef3 match
ike 0:phase-1-int:193473:phase-2-int:4954165: delete phase2 SPI d888eef

I've asked the Cisco admin for config details and after comparison we have

Phase_1

the same Diffie-Hellman group the same proposal (aes256 - sha512) the same keylife (in seconds) Phase_2

The same Diffie-Hellman group ("dhgrp" parameter on Fortigate and "pfs" parameter on Cisco)

The same keylife (in kilobytes)

Proposals are:

Fortigate

set proposal aes256-sha512
Cisco

set transform-set esp-aes_256_esp-sha512-hmac
crypto ipsec transform-set esp-aes_256_esp-sha512-hmac esp-aes 256 esp-sha512-hmac
Can anyone tell me what could be wrong?

I'm not network specialist and I don't know even what to ask the mentioned Cisco admin.

Any help appreciated.

 

Best regards

Alex

    Best answer by Xander

    Hi Kadkwai

    I've solved the problem after a lot of troubleshooting together with very skilled friend of mine.

    I had to solve 2 issues:

    1 - We had to NAT the traffic before it went into the tunnel (office lan -> NAT -> VPN tunnel)

    2 - Than we received information that on the Cisco side the phase2 interface is configured to match specified IP addresses that are on the access list only (we specified the addresses before so we knew them all)

    match address ac-list

    My final configs are as follows Phase1

    edit "vpn-p1"
     set interface "wan1"
     set keylife 28800
     set proposal aes256-sha512
     set dhgrp 20
     set mesh-selector-type subnet <- this allows to provide several addresses "remote-networks-on-ac-list", see phase2 below
     set remote-gw [1.2.3.4]
     set psksecret ENC secret
     next

    Phase 2

    edit "vpn-p2"
     set phase1name "vpn-p1"
     set proposal aes256-sha512
     set dhgrp 20
     set auto-negotiate enable
     set keylife-type kbs
     set src-addr-type name <- we need that to NAT our traffic
     set dst-addr-type name <- we need that to mach the IP put on cisco access list
     set keylifekbs 512000
     set src-name "our-nat-ip" <- we need that to NAT our traffic
     set dst-name "remote-networks-on-ac-list" <- we need that to mach the IP put on cisco access list
     next

    src-name and dst-name you can define in

    config firewall address

    e.g.

    edit "our-nat-ip"
     set subnet 3.4.5.6 255.255.255.255
    next
    edit "network-1"
     set subnet 192.168.1.0 255.255.255.0
    next
    edit "network-2"
     set subnet 192.168.2.0 255.255.255.0
    next

    and

    config firewall addrgrp

    e.g.

    edit "remote-networks-on-ac-list"
     set member "network-1" "network-2"
     set allow-routing enable
     next

    Hope this helps!

    BR

    Alex

    1 reply

    moby
    moby
    New Member
    March 27, 2017

    Hi Alex,

     

    The above Cisco configuration only show the phase 2 (IPSEC) configuration. You should also check the phase 1 configuration for the Cisco router which would been shown in the ISAKMP policy in the configuration of the Cisco router. Also is dead peer detection enabled/disabled at each end?

     

    Moby

    MikePruett
    MikePruett
    New Member
    March 27, 2017

    Making sure things match 100% is my go to. Things like NAT-T, timers being off, encryption / authentication means being incorrect etc.

     

    Remember, the FortiGate will follow RFC perfectly. So if the Cisco side doesn't match 100% it will kill it. For instance, Palo Alto firewalls you can chose the timer as a period of days etc. Even if the FortiGate has the correct number of seconds in the timer that matches said day period of the Palo the connection will fail.

     

     

    Xander
    XanderAuthor
    New Member
    March 28, 2017

    The below config is all that I've got from the Cisco admin.

    The parts marked [in square braces] were changed by me to anonymize some entries

     

    crypto isakmp policy ###
    encr aes 256
    hash sha512
    authentication pre-share
    group 20
    lifetime 28800
    crypto map [name] [##] ipsec-isakmp
    set peer [1.2.3.4]
    set security-association lifetime kilobytes 512000
    set transform-set esp-aes_256_esp-sha512-hmac
    set pfs group20
    match address [ac-name]
    reverse-route

    crypto ipsec transform-set esp-aes_256_esp-sha512-hmac esp-aes 256 esp-sha512-hmac

     

    Regarding the DPD: I don't know if it is turned on on Cisco side but I can see something like this in the logs:

     

    ike 0:phase-1-int:193469: sent IKE msg (R-U-THERE): 1.2.3.4:500->5.6.7.8:500, len=140, id=[...]
    ike 0:phase-1-int:193469: notify msg received: R-U-THERE-ACK

     

    Does indicates that DPD works fine or not necessarily?

     

    My config is as follows

     

    phase-1-int

     
    config vpn ipsec phase1-interface
     edit "phase-1-int"
     set interface "wan1"
     set local-gw [1.2.3.4]
     set keylife 28800
     set proposal aes256-sha512
     set dpd on-idle
     set dhgrp 20
     set remote-gw [5.6.7.8]
     set psksecret ENC (encrypted)
     set dpd-retryinterval 10
     next
    end
     
     
    phase-2-int
     
    config vpn ipsec phase2-interface
     edit "phase-2-int"
     set phase1name "phase-1-int"
     set proposal aes256-sha512
     set dhgrp 20
     set auto-negotiate enable
     set keylife-type kbs
     set src-addr-type ip
     set keylifekbs 512000
     set src-start-ip [9.10.11.12]
     next
    end
     
     
    
        
                                                
    
        
    
    
    

            
    
                                        
    
            
                        
    
                                                                                                            
            
    

    

    

        
    
                    
    
    
    
    

    

    
    
    

                                        
    
                                                        
    
            
        
    
    

    

    

                                    
    Terms & ConditionsAccessibility statement