Skip to main content
KPS
KPS
New Member
May 17, 2018
Question

VPN from VDOM

  • May 17, 2018
  • 1 reply
  • 5373 views

Hi!

 

I am trying to setup the following:

 

Fortigate with three VDOMS:

- VDOM-Outside with static ip

- VDOM-Inside1 - Company 1

- VDOM-Inside2 - Company 2

 

The setup is working with everything except VPN (accessing internet-addresses from VDOM-Inside is possible):

 

VDOM-Inside1 schould start a VPN-tunnel to the HQ of Company 1.

The VPN is configured with NAT-Traversal. Phase 1+2 are configured, but:

 

- Phase 1 seems to be started in any way (I see packets in the HQ from the branch-office-IP). The VPN-events-log shows: "progress IPSec phase 1, success"

- Phase 2 does never get established - no logging, no tries.

 

 

Can you give me a hint, what I have to do?

 

diag debug application ike -1

shows:

 

ike 3:ToDW: auto-negotiate connection ike 3:ToDW: created connection: 0x39a8ea8 25 10.93.93.1->217.7.67.10:500. ike 3:ToDW:173: initiator: aggressive mode is sending 1st message... ike 3:ToDW:173: cookie 312dd12f591c4e42/0000000000000000 ike 3:ToDW:173: out  ike 3:ToDW:173: sent IKE msg (agg_i1send): 10.93.93.1:500->217.7.XX.XX:500, len=477, id=312dd12f591c4e42/0000000000000000 ike 3:ToDW:ToDW: IPsec SA connect 25 10.93.93.1->217.7.XX.XX:0 ike 3:ToDW:ToDW: using existing connection ike 3:ToDW:ToDW: config found ike 3:ToDW:ToDW: IPsec SA connect 25 10.93.93.1->217.7.XX.XX:500 negotiating ike 3:ToDW:173:ToDW:766: ISAKMP SA still negotiating, queuing quick-mode request ike 3:ToDW:173: out 312DD12F591C4E42000000000000.. ike 3:ToDW:173: sent IKE msg (P1_RETRANSMIT): 10.93.93.1:500->217.7.XX.XX:500, len=477, id=312dd12f591c4e42/0000000000000000 ike 3:ToDW:ToDW: IPsec SA connect 25 10.93.93.1->217.7.67.10:0 ike 3:ToDW:ToDW: using existing connection

Thank you for your help!!

 

KPS

    1 reply

    AtiT
    AtiT
    New Member
    May 17, 2018

    Hello,

    I am not an IPSec guru but my experience is that I do not check the logs for IPSec. For me the message P1_RETRANSMIT means that the phase1 is not up.

     

    In my cases it was always bad phase1 configuration on one or other side of the tunel.

    Is there any reason you are using aggressive mode in IPSec config?

    KPS
    KPSAuthor
    New Member
    May 17, 2018

    Hi!

     

    I am using Aggressive Mode because of two reasons:

    - I need to use dynamic IPs in the branch office

    - I want to have the option to add a second ISP.

     

    I checked everything twice and think, the configuration should be o.k. If I use the same config on the "Outside-VDOM", the tunnel is working fine. It must be related with the VDOM-part of the config.

    KPS
    KPSAuthor
    New Member
    May 17, 2018

    Hi!

     

    Sorry! It was my fault. The problem has been on the "other side" of the tunnel.

     

    Sorry!!

    Terms & ConditionsAccessibility statement