New Member

Question

site to site vpn tunnel is up but no traffic flowing

Forum|Forum|7 years ago
August 14, 2019
34 replies
51304 views

setup site to site vpn using the ipsec wizard. tunnel is already up but keeps on getting the error "progress ipsec phase 1 negotiate failure" in vpn events log. need your help where and what to check.

note: i initially setup ssl vpn on the same fortigate and it works well. trying to setup the site to site vpn now. the setup on the ipsec wizard is easy and fast. but it is not working.

please advise. thanks.

Toshi_Esumi

SuperUser

I'm assuming your tunnel is working fine. Then take a close look at the log detail. Does the remote IP match the IP of the other side of your VPN? Chances are somebody else is trying to set up VPN to your FGT.

fortinoyAuthor

New Member

The IPs on both sides are correct. What do you mean when you say "Chances are somebody else is trying to set up VPN to your FGT."? I have setup SSL VPN too on the same Fortigate on both sides. Will that affect the site to site vpn i'm trying to setup? Thanks.

OneOfUs

New Member

Based on this:

ike 0:”LOCAL VPN NAME”: sending SNMP tunnel DOWN trap for “LOCAL VPN NAME” ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21:[style="background-color: #ffff00;"] my proposal:[/style] ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: [style="background-color: #ffff00;"]proposal id = 1[/style]: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: protocol id = IPSEC_ESP: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: PFS DH group = 14 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: [style="background-color: #ff0000;"]proposal id = 2:[/style] ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: protocol id = IPSEC_ESP: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: PFS DH group = 5 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: incoming proposal: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: proposal id = 1: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: protocol id = IPSEC_ESP: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: PFS DH group = 14 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: [style="background-color: #00ff00;"]negotiation result[/style] ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: proposal id = 1: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: protocol id = IPSEC_ESP: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: PFS [style="background-color: #00ffff;"]DH[/style] group = [style="background-color: #00ffff;"]14[/style] ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_[style="background-color: #00ffff;"]AES[/style]_CBC (key_len = [style="background-color: #00ffff;"]128[/style]) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=[style="background-color: #00ffff;"]SHA1[/style] ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: [style="background-color: #00ff00;"]sending SNMP tunnel UP trap[/style]

It appears the phase 1 (IKE) is coming up and the issue is with the phase 2 (IPSEC) negotiation. The only thing I saw odd in the debug is that you appear to have two phase 2 selectors however the remote only has one. It may help to eliminate the 2nd phase 2 selector and additional (unneeded) encryption / authentication protocols. Make sure the phase 2 local / remote addresses match.

The phase 2 negotiation appears to complete using: AES-128 SHA1 DH 14 Keylife 43200.

If you look at the IPSEC VPN monitor does the tunnel appear to bounce?

OneOfUs

New Member

This is the best article I've found to troubleshoot IPSEC VPNs, some of the GUI information has changed over the years:

To get diagnose information for the VPN connection - CLI

1.Log into the CLI as admin with the output being logged to a file.

2.Stop any diagnose debug sessions that are currently running with the CLI command

diagnose debug disable

3.Clear any existing log-filters by running

diagnose vpn ike log-filter clear

4.Set the log-filter to the IP address of the remote computer (Remote Gateway). This filters out all VPN connections except ones to the IP address we are concerned with. The command is

diagnose vpn ike log-filter dst-addr4 <remote gateway>

5.Set up the commands to output the VPN handshaking. The commands are:

diagnose debug app ike 63

diagnose debug enable

6.Have the remote FortiGate initiate the VPN connection in the web-based manager by going to VPN > Monitor and selecting Bring up.

This makes the remote FortiGate the initiator and the local FortiGate becomes the responder. Establishing the connection in this manner means the local FortiGate will have its configuration information as well as the information the remote computer sends. Having both sets of information locally makes it easier to troubleshoot your VPN connection.

7.Watch the screen for output, and after roughly 15 seconds enter the following CLI command to stop the output.

diagnose debug disable

8.If needed, save the log file of this output to a file on your local computer. Saving the output to a file can make it easier to search for a particular phrase, and is useful for comparisons.

From <http://docs-legacy.fortinet.com/fos50hlp/50/FortiOS%205.0%20Help/TestandMonitor.129.08.html>

fortinoyAuthor

New Member

Thanks for the steps. Please help me to check the result of the debug below. I replaced the ips and the vpn names for security.

LEGEND:

“local FG public ip” "remote FG public ip" "local vpn name" "remote vpn name" "remote FG LAN ip" "local FG LAN ip"

FGT60ETK180999ZJ # ike shrank heap by 126976 bytes ike 0: comes "remote FG public ip:"500“local FG public ip”:500,ifindex=6.... ike 0: IKEv1 exchange=Informational id=1bb17d97025b7eba/126b50d856d51ce4:c40c60a2 len=92 ike 0: "local vpn name":327: recv IPsec SA delete, spi count 1 ike 0: "local vpn name": deleting IPsec SA with SPI 4d6c1357 ike 0: "local vpn name":"local vpn name": deleted IPsec SA with SPI 4d6c1357, SA count: 0 ike 0: "local vpn name": sending SNMP tunnel DOWN trap for "local vpn name" ike 0: comes "remote FG public ip":500->“local FG public ip”:500,ifindex=6.... ike 0: IKEv1 exchange=Quick id=1bb17d97025b7eba/126b50d856d51ce4:25461b74 len=588 ike 0: "local vpn name":327:19: responder received first quick-mode message ike 0: "local vpn name":327:19: peer proposal is: peer:0: "remote FG LAN ip"-"remote FG LAN ip", me:0: "local FG LAN ip"-"local FG LAN ip" ike 0: "local vpn name":327: "local vpn name":19: trying ike 0: "local vpn name":327: "local vpn name":19: matched phase2 ike 0: "local vpn name":327: "local vpn name":19: autokey ike 0: "local vpn name":327: "local vpn name":19: my proposal: ike 0: "local vpn name":327: "local vpn name":19: proposal id = 1: ike 0: "local vpn name":327: "local vpn name":19: protocol id = IPSEC_ESP: ike 0: "local vpn name":327: "local vpn name":19: PFS DH group = 14 ike 0: "local vpn name":327: "local vpn name":19: trans_id = ESP_AES_CBC (key_len = 128) ike 0: "local vpn name":327: "local vpn name":19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0: "local vpn name":327: "local vpn name":19: type = AUTH_ALG, val=SHA1 ike 0: "local vpn name":327: "local vpn name":19: trans_id = ESP_AES_CBC (key_len = 256) ike 0: "local vpn name":327: "local vpn name":19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0: "local vpn name":327: "local vpn name":19: type = AUTH_ALG, val=SHA1 ike 0: "local vpn name":327: "local vpn name":19: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=SHA2_256 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_AES_CBC (key_len = 256) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=SHA2_256 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_AES_GCM_16 (key_len = 128) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=NULL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_AES_GCM_16 (key_len = 256) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=NULL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_CHACHA20_POLY1305 (key_len = 256) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=NULL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: proposal id = 2: ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: protocol id = IPSEC_ESP: ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: PFS DH group = 5 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_AES_CBC (key_len = 256) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=SHA2_256 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_AES_CBC (key_len = 256) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=SHA2_256 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_AES_GCM_16 (key_len = 128) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=NULL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_AES_GCM_16 (key_len = 256) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=NULL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_CHACHA20_POLY1305 (key_len = 256) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=NULL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: incoming proposal: ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: proposal id = 1: ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: protocol id = IPSEC_ESP: ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: PFS DH group = 14 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_AES_CBC (key_len = 256) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_3DES ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=SHA2_256 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_AES_CBC (key_len = 256) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=SHA2_256 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_3DES ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=SHA2_256 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: negotiation result ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: proposal id = 1: ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: protocol id = IPSEC_ESP: ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: PFS DH group = 14 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: set pfs=MODP2048 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: using tunnel mode. ike 0:”LOCAL VPN NAME”: schedule auto-negotiate ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: replay protection enabled ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: SA life soft seconds=42929. ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: SA life hard seconds=43200. ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: IPsec SA selectors #src=1 #dst=1 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: src 0 4 0:”local FG LAN ip”/255.255.255.0:0 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: dst 0 4 0:”remote FG LAN ip”/255.255.255.0:0 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: add IPsec SA: SPIs=0c219574/4d6c1358 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: added IPsec SA: SPIs=0c219574/4d6c1358 ike 0:”LOCAL VPN NAME”:327:”LOCAL VPN NAME”:19: sending SNMP tunnel UP trap ike 0:”LOCAL VPN NAME”:327: sent IKE msg (quick_r1send): “local FG public ip”:500->“remote FG public ip”:500, len=444, id=1bb17d97025b7eba/126b50d856d51ce4:25461b74 ike 0: comes “remote FG public ip”:500->“local FG public ip”:500,ifindex=6.... ike 0: IKEv1 exchange=Quick id=1bb17d97025b7eba/126b50d856d51ce4:25461b74 len=76 ike 0:”LOCAL VPN NAME”:”LOCAL VPN NAME”:19: send SA_DONE SPI 0x4d6c1358 FGT60ETK180999ZJ # diagnose debug disable=========== ================================================ FGT60ETK180999ZJ # ike shrank heap by 126976 bytes ike 0: comes “remote FG public ip”:500->“local FG public ip”:500,ifindex=6.... ike 0: IKEv1 exchange=Informational id=936e3ddcaaec9ef2/af17441d730dc067:ebcb47ca len=92 ike 0:”LOCAL VPN NAME”:330: recv IPsec SA delete, spi count 1 ike 0:”LOCAL VPN NAME”: deleting IPsec SA with SPI 4d6c1359 ike 0:”LOCAL VPN NAME”:”LOCAL VPN NAME”: deleted IPsec SA with SPI 4d6c1359, SA count: 0 ike 0:”LOCAL VPN NAME”: sending SNMP tunnel DOWN trap for “LOCAL VPN NAME” ike 0: comes “remote FG public ip”:500->“local FG public ip”:500,ifindex=6.... ike 0: IKEv1 exchange=Quick id=936e3ddcaaec9ef2/af17441d730dc067:42eb0de9 len=588 ike 0:”LOCAL VPN NAME”:330:21: responder received first quick-mode message ike 0:”LOCAL VPN NAME”:330:21: peer proposal is: peer:0:”remote FG LAN ip”-192.168.100.255:0, me:0:”local FG LAN ip”-192.168.17.255:0 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trying ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: matched phase2 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: autokey ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: my proposal: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: proposal id = 1: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: protocol id = IPSEC_ESP: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: PFS DH group = 14 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 256) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA2_256 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 256) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA2_256 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_GCM_16 (key_len = 128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=NULL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_GCM_16 (key_len = 256) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=NULL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_CHACHA20_POLY1305 (key_len = 256) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=NULL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: proposal id = 2: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: protocol id = IPSEC_ESP: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: PFS DH group = 5 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 256) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA2_256 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 256) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA2_256 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_GCM_16 (key_len = 128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=NULL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_GCM_16 (key_len = 256) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=NULL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_CHACHA20_POLY1305 (key_len = 256) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=NULL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: incoming proposal: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: proposal id = 1: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: protocol id = IPSEC_ESP: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: PFS DH group = 14 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 256) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_3DES ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA2_256 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 256) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA2_256 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_3DES ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA2_256 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: negotiation result ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: proposal id = 1: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: protocol id = IPSEC_ESP: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: PFS DH group = 14 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: set pfs=MODP2048 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: using tunnel mode. ike 0:”LOCAL VPN NAME”: schedule auto-negotiate ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: replay protection enabled ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: SA life soft seconds=42930. ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: SA life hard seconds=43200. ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: IPsec SA selectors #src=1 #dst=1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: src 0 4 0:”local FG LAN ip”/255.255.255.0:0 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: dst 0 4 0:”remote FG LAN ip”/255.255.255.0:0 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: add IPsec SA: SPIs=0c219576/4d6c135a ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: added IPsec SA: SPIs=0c219576/4d6c135a ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: sending SNMP tunnel UP trap ike 0:”LOCAL VPN NAME”:330: sent IKE msg (quick_r1send): “local FG public ip”:500->“remote FG public ip”:500, len=444, id=936e3ddcaaec9ef2/af17441d730dc067:42eb0de9 ike 0: comes “remote FG public ip”:500->“local FG public ip”:500,ifindex=6.... ike 0: IKEv1 exchange=Quick id=936e3ddcaaec9ef2/af17441d730dc067:42eb0de9 len=76 ike 0:”LOCAL VPN NAME”:”LOCAL VPN NAME”:21: send SA_DONE SPI 0x4d6c135a FGT60ETK180999ZJ # ike 0:”LOCAL VPN NAME”:326: expiring IKE SA e8819280293ca8bf/f0e01864a2ffc7c3 ike 0:”LOCAL VPN NAME”:326: send IKE SA delete e8819280293ca8bf/f0e01864a2ffc7c3 ike 0:”LOCAL VPN NAME”:326: sent IKE msg (ISAKMP SA DELETE-NOTIFY): “local FG public ip”:500->“remote FG public ip”:500, len=108, id=e8819280293ca8bf/f0e01864a2ffc7c3:0bb860e3 ike 0:”LOCAL VPN NAME”: schedule auto-negotiate ike 0: comes “remote FG public ip”:500->“local FG public ip”:500,ifindex=6.... ike 0: IKEv1 exchange=Informational id=e8819280293ca8bf/f0e01864a2ffc7c3:439f8810 len=108 ike 0: no established IKE SA for exchange-type Informational from “remote FG public ip”:500->“local FG public ip” 6 cookie e8819280293ca8bf/f0e01864a2ffc7c3, drop ike 0:”LOCAL VPN NAME”:327: expiring IKE SA 1bb17d97025b7eba/126b50d856d51ce4 ike 0:”LOCAL VPN NAME”:327: send IKE SA delete 1bb17d97025b7eba/126b50d856d51ce4 ike 0:”LOCAL VPN NAME”:327: sent IKE msg (ISAKMP SA DELETE-NOTIFY): “local FG public ip”:500->“remote FG public ip”:500, len=108, id=1bb17d97025b7eba/126b50d856d51ce4:c9c0f7d6 ike 0:”LOCAL VPN NAME”: schedule auto-negotiate

sw2090

SuperUser

Well Ipsec is cool when it works but its a pain in the a** to debug :/ That's not on Fortinet but something to blame ipsec itself for.

Accoarding to the logs I see no negotiation errors or timeouts. Just the tunnel going up and then down again sending the specific smtp trap.

Did you check if your Key TTLS in phase1 AND 2 do match on both sides?

Toshi_Esumi

SuperUser

For the log you saw was "IPsec". Nothing to do with SSL VPN or other types of VPNs. If somebody from other country is trying to set up a VPN to exploit your network at the public IP on the interface, you would see those logs. It actually happens quite often than not. That's why I asked if the remote IP in the log is the IP for your VPN's remote IP.

OneOfUs

New Member

Based on this: ike 0:”LOCAL VPN NAME”: sending SNMP tunnel DOWN trap for “LOCAL VPN NAME” ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21:[<font] my proposal: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: [<font]proposal id = 1: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: protocol id = IPSEC_ESP: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: PFS DH group = 14 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: [<font]proposal id = 2: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: protocol id = IPSEC_ESP: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: PFS DH group = 5 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: incoming proposal: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: proposal id = 1: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: protocol id = IPSEC_ESP: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: PFS DH group = 14 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_AES_CBC (key_len = 128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=SHA1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: [<font]negotiation result ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: proposal id = 1: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: protocol id = IPSEC_ESP: ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: PFS [<font]DH group = [<font]14 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: trans_id = ESP_[<font]AES_CBC (key_len = [<font]128) ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: type = AUTH_ALG, val=[<font]SHA1 ike 0:”LOCAL VPN NAME”:330:”LOCAL VPN NAME”:21: [<font]sending SNMP tunnel UP trap It appears the phase 1 (IKE) is coming up and the issue is with the phase 2 (IPSEC) negotiation. The only thing I saw odd in the debug is that you appear to have two phase 2 selectors however the remote only has one. It may help to eliminate the 2nd phase 2 selector and additional (unneeded) encryption / authentication protocols. Make sure the phase 2 local / remote addresses match. The phase 2 negotiation appears to complete using: AES-128 SHA1 DH 14 Keylife 43200. If you look at the IPSEC VPN monitor does the tunnel appear to bounce?

fortinoyAuthor

New Member

regarding the sdwan setup for ipsec, our setup shows only 1 tunnel interface which is under wan1 on the remote fortigate. the config on the KB shows 2 separate tunnels. both local and remote fortigates are in production. i'm not sure how to create two separate tunnel interfaces for one site to site vpn. sorry i'm really new at this.

i tried adding sdwan rules this time, but same issue. tunnel is up, no traffic coming into the tunnel.

Here is a screen shot of the policy from local to remote LAN via from LAN to TUNNEL

Here is the policy from remote to local LAN from TUNNEL to LAN

Here is the screenshot of the static route:

i can provide more screenshots if you need me to. thanks for all your help. really appreciate it.

fortinoyAuthor

New Member

regarding the config on the KB, it has 2 tunnel interfaces. our setup only has 1 tunnel interface. sdwan was only used for the default route for the internet. the tunnel was still bind under wan 1. i tried adding sd wan rules for the internet and access to the lan traffic but same issue.

i will try to post pics here of our setup.

attach here is our static route

nzap7.JPG

fortinoyAuthor

New Member

looks like i can only attach one pic at a time.

here is the policy from remote to local LAN

nzap5.JPG

fortinoyAuthor

New Member

UPDATE:

from the remote fortigate CLI, i can ping the server behind the local fortigate. however, i cannot ping the pc behind the remote fortigate from the CLI of local fortigate.

if i ping the server behind the local fortigate using a pc behind the remote fortigate, it fails. i also cannot ping a pc from the remote fortigate using the server behind the local fortigate.

Here is the latest debug on the remote fortigate:

FG100ETK18010728 $ ike 0:REMOTE VLAN NAME:REMOTE VLAN NAME:2: admin flush IPsec SA

ike 0:REMOTE VLAN NAME: flushing REMOTE VLAN NAME

ike 0:REMOTE VLAN NAME: deleting IPsec SA with SPI 0c21a003

ike 0:REMOTE VLAN NAME:REMOTE VLAN NAME: deleted IPsec SA with SPI 0c21a003, SA count: 0

ike 0:REMOTE VLAN NAME: sending SNMP tunnel DOWN trap for REMOTE VLAN NAME

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:703: sending delete for IPsec SA SPI dec858ab

ike 0:REMOTE VLAN NAME:610:704: send informational

ike 0:REMOTE VLAN NAME:610: sent IKE msg (INFORMATIONAL): REMOTE WAN IP:500->LOCAL WAN IP:500, len=80, id=8483ff7338bdefcc/77459347bf53a36f:00000003

ike 0:REMOTE VLAN NAME:REMOTE VLAN NAME: sending SNMP tunnel DOWN trap

ike 0:REMOTE VLAN NAME: deleting IPsec SA with SPI 0c21a003

ike 0:REMOTE VLAN NAME: flushed REMOTE VLAN NAME

ike 0: comes LOCAL WAN IP:500->REMOTE WAN IP:500,ifindex=7....

ike 0: IKEv2 exchange=INFORMATIONAL_RESPONSE id=8483ff7338bdefcc/77459347bf53a36f:00000003 len=80

ike 0:REMOTE VLAN NAME:610: received informational response

ike 0:REMOTE VLAN NAME:610:704: processing informational acknowledgement

ike 0:REMOTE VLAN NAME:610: processing delete ack (proto 3)

ike 0:REMOTE VLAN NAME: deleting IPsec SA with SPI 0c21a003

ike 0:REMOTE VLAN NAME:REMOTE VLAN NAME: IPsec SA connect 7 REMOTE WAN IP->LOCAL WAN IP:0

ike 0:REMOTE VLAN NAME:REMOTE VLAN NAME: using existing connection

ike 0:REMOTE VLAN NAME:REMOTE VLAN NAME: config found

ike 0:REMOTE VLAN NAME:REMOTE VLAN NAME: IPsec SA connect 7 REMOTE WAN IP->LOCAL WAN IP:500 negotiating

ike 0:REMOTE VLAN NAME:610:705 initiating CREATE_CHILD exchange

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: PFS enabled

ike 0:REMOTE VLAN NAME:610: sent IKE msg (CREATE_CHILD): REMOTE WAN IP:500->LOCAL WAN IP:500, len=480, id=8483ff7338bdefcc/77459347bf53a36f:00000004

ike 0: comes LOCAL WAN IP:500->REMOTE WAN IP:500,ifindex=7....

ike 0: IKEv2 exchange=CREATE_CHILD_RESPONSE id=8483ff7338bdefcc/77459347bf53a36f:00000004 len=464

ike 0:REMOTE VLAN NAME:610: received create-child response

ike 0:REMOTE VLAN NAME:610: initiator received CREATE_CHILD msg

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: found child SA SPI dec858ac state=3

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: PFS enabled, group=14

ike 0:REMOTE VLAN NAME:610:705: peer proposal:

ike 0:REMOTE VLAN NAME:610:705: TSr_0 0:0.0.0.0-255.255.255.255:0

ike 0:REMOTE VLAN NAME:610:705: TSi_0 0:0.0.0.0-255.255.255.255:0

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: comparing selectors

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: matched by rfc-rule-2

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: phase2 matched by subset

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: accepted proposal:

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: TSr_0 0:0.0.0.0-255.255.255.255:0

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: TSi_0 0:0.0.0.0-255.255.255.255:0

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: autokey

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: incoming child SA proposal:

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: proposal id = 1:

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: protocol = ESP:

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: encapsulation = TUNNEL

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: type=ENCR, val=AES_CBC (key_len = 256)

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: type=INTEGR, val=SHA256

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: type=DH_GROUP, val=MODP2048

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: type=ESN, val=NO

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: matched proposal id 1

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: proposal id = 1:

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: protocol = ESP:

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: encapsulation = TUNNEL

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: type=ENCR, val=AES_CBC (key_len = 256)

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: type=INTEGR, val=SHA256

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: type=DH_GROUP, val=MODP2048

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: type=ESN, val=NO

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: lifetime=28800

ike 0:REMOTE VLAN NAME: schedule auto-negotiate

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: replay protection enabled

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: set sa life soft seconds=28500.

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: set sa life hard seconds=28800.

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: IPsec SA selectors #src=1 #dst=1

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: src 0 7 0:0.0.0.0-255.255.255.255:0

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: dst 0 7 0:0.0.0.0-255.255.255.255:0

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: add IPsec SA: SPIs=dec858ac/0c21a004

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: added IPsec SA: SPIs=dec858ac/0c21a004

ike 0:REMOTE VLAN NAME:610:REMOTE VLAN NAME:705: sending SNMP tunnel UP trap

ike shrank heap by 126976 bytes

ike 0:REMOTE VLAN NAME: link is idle 7 REMOTE WAN IP->LOCAL WAN IP:0 dpd=2 seqno=57

ike 0:REMOTE VLAN NAME:610: send IKEv2 DPD probe

ike 0:REMOTE VLAN NAME:706: sending NOTIFY msg

ike 0:REMOTE VLAN NAME:610:706: send informational

ike 0:REMOTE VLAN NAME:610: sent IKE msg (INFORMATIONAL): REMOTE WAN IP:500->LOCAL WAN IP:500, len=80, id=8483ff7338bdefcc/77459347bf53a36f:00000005

ike 0: comes LOCAL WAN IP:500->REMOTE WAN IP:500,ifindex=7....

ike 0: IKEv2 exchange=INFORMATIONAL_RESPONSE id=8483ff7338bdefcc/77459347bf53a36f:00000005 len=80

ike 0:REMOTE VLAN NAME:610: received informational response

ike 0:REMOTE VLAN NAME:706: received NOTIFY acknowledgement

ike 0:REMOTE VLAN NAME:610:706: processing informational acknowledgement

ike 0: comes LOCAL WAN IP:500->REMOTE WAN IP:500,ifindex=7....

ike 0: IKEv2 exchange=INFORMATIONAL id=8483ff7338bdefcc/77459347bf53a36f:00000004 len=80

ike 0:REMOTE VLAN NAME:610: received informational request

ike 0:REMOTE VLAN NAME:610: sent IKE msg (INFORMATIONAL_RESPONSE): REMOTE WAN IP:500->LOCAL WAN IP:500, len=80, id=8483ff7338bdefcc/77459347bf53a36f:00000004

Hope you guys will continue to help me check. Thanks.

sistemasRCR

Explorer II

I got the same problem, could you solve it?

Sign up

Login with SSO

Login to the community

Login with SSO