Question
Site to Site VPN Fortigate - Cisco ASA, Cisco sees Anti-Replay Attack.
Our fortigate 1000c - v5.0,build0228 (GA Patch 4) Was upgraded from version 4.0 last week. We have a VPN to a Cisco ASA which is not managed by us. The party from the remote peer reported that they needed to turn off anti-replay checks on the ASA because it was seen that the fortigate was attacking it. I have attached the Cisco information. %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0xEDA2CA6E, sequence number= 0x8CC) from A.A.A.A (user= A.A.A.A) to B.B.B.B that failed anti-replay checking. %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0xEDA2CA6E, sequence number= 0x8CD) from A.A.A.A (user= A.A.A.A) to B.B.B.B that failed anti-replay checking. %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0x0E972C69, sequence number= 0x12EC) from A.A.A.A (user= A.A.A.A) to B.B.B.B that failed anti-replay checking. %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0x0E972C69, sequence number= 0x12ED) from A.A.A.A (user= A.A.A.A) to B.B.B.B that failed anti-replay checking. %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0x0E972C69, sequence number= 0x12EE) from A.A.A.A (user= A.A.A.A) to B.B.B.B that failed anti-replay checking. %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0x0E972C69, sequence number= 0x12EF) from A.A.A.A (user= A.A.A.A) to B.B.B.B that failed anti-replay checking. %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0x0E972C69, sequence number= 0x12F0) from A.A.A.A (user= A.A.A.A) to B.B.B.B that failed anti-replay checking. why is the fortigate doing this?
