New Member

Solved

vpn ipsec between Fortigate 5.2.2 and pfSense

Forum|Forum|11 years ago
February 1, 2015
9 replies
88574 views

Hello,

I try in every mode to come up vpn tunnel between Fortigate with 5.2.2 and pfSense, I receive error before phase 1, with message "ignoring ike request, no policy configured" but I check 100 times... every is correct on both side. This is first time I do vpn to pfSense, I have other vpn with Cisco and Watchguard without problem, then I try change pfSense with Sophos but same result, I know that both use vpn based on openswan.

Thanks

M.

Best answer by mmishra_FTNT

Hello,

"ignoring ike request, no policy configured" usually suggests firewall policy missing for Virtual IPSEC interface.

You might want to cross check firewall policies on Fortigate, there should be following two polices configured:

1>IPSEC virtual interface -> Internal interface (Where network for which traffic is to be send over VPN is connected)

2>Internal interface -> IPSEC virtual interface

Assuming VPN configured are in interface mode

emnoc

New Member

On your fortigate I'm assuming interface mode, but the cfg is simple and straight-forward regardless. Just ensure you have correct policies on both sides and narrow the proposals to exact what you want.

Just be careful of your policies and the ipsec configuration & proposals.

You might get luckly on the pfSense side with; cat /var/etc/ipsec/racoon.conf your config should very similar.

# This file is automatically generated. Do not edit path pre_shared_key "/var/etc/ipsec/psk.txt"; path certificate "/var/etc/ipsec"; listen { adminsock "/var/db/racoon/racoon.sock" "root" "wheel" 0660; isakmp 1.1.1.1 [500]; isakmp_natt 1.1.1.1[4500]; } mode_cfg { auth_source external; group_source system; pool_size 253; network4 172.16.254.1; netmask4 255.255.255.0; split_network include 172.16.99.0/24; dns4 8.8.8.8; dns4 8.8.4.4; default_domain "mydomain.net"; split_dns "mydomain.net"; banner "/var/etc/ipsec/racoon.motd"; } extcfg { script "/var/etc/ipsec/ipsec.php" } remote anonymous { ph1id 1; exchange_mode aggressive; my_identifier address 1.1.1.1; peers_identifier user_fqdn "me@hyperfeed.net"; ike_frag on; generate_policy = unique; initial_contact = off; nat_traversal = on; dpd_delay = 10; dpd_maxfail = 5; support_proxy on; proposal_check obey; passive on; proposal { authentication_method xauth_psk_server; encryption_algorithm 3des; hash_algorithm md5; dh_group 2; lifetime time 28800 secs; } } sainfo anonymous { remoteid 1; encryption_algorithm 3des; authentication_algorithm hmac_sha1,hmac_md5; lifetime time 3600 secs; compression_algorithm deflate; } sainfo subnet 172.16.99.0/24 any subnet 172.16.22.0/24 any { remoteid 3; encryption_algorithm 3des; authentication_algorithm hmac_sha1; lifetime time 3600 secs; compression_algorithm deflate; } sainfo subnet 172.16.99.0/24 any subnet 172.16.20.0/24 any { remoteid 3; encryption_algorithm 3des; authentication_algorithm hmac_sha1; lifetime time 3600 secs; compression_algorithm deflate; }

amatteo78Author

New Member

Hello,

on pfSense I haven't racoon but I have strongswan.

I check both side con, and every setting are same. I don't understand why not work.

M.

amatteo78Author

New Member

Hello,

also on my side I have pfSense 2.2, I attach config from Fortigate:

Phase 1:

edit "PF01 EGSI" set interface "port1" set keylife 14400 set mode-cfg enable set proposal 3des-sha1 set dpd disable set dhgrp 2 set remote-gw 37.59.208.193 set unity-support disable set psksecret ENC LCVkCsdFthy2N1YsRH8bcKqRfqfPXaslUE74jEIsm9I0TeJ5aQbk7i3NPQZnFE01CrtstUpXfNPhL1IJFKuv715stM6OtzVw9sK/AE5v5D9HPFTvWUtkvL8wQc+tZmE7FsnKgdJV4FrqEgCYsu+tOghCQ4JOcrXvapqnVhPq9J3VC1rdWSmVyuQaf/Cu2MwAFxFrvQ== next end

Phase 2:

edit "PF01 EGSI" set phase1name "PF01 EGSI" set proposal 3des-sha1 set pfs disable set replay disable set keepalive enable set auto-negotiate enable set keylifeseconds 8800 next end

Now I attach screen config take from web panel in pfSense:

I attach Phase 2 in other reply.

Thanks

M.

Phase1_pfSense.jpg

emnoc

New Member

Dump your openSwan and fortigate config & start some diagnostics. Also take a look at ipsec vpn tshooting.

http://socpuppet.blogspot.com/2013/10/site-2-site-routed-vpn-trouble-shooting.html

It's based on rt-based but a policy-base would be very similar minus the routes. Also what version of pfSense are you running? I thought they gotten off openswan many releases ago. I'm on 2.2 pfsense.

emnoc

New Member

Here's what you need todo;

on the phase1 at the fortigte unset and disable the following;

edit "PF01 EGSI"

set mode-cfg disable

set keylife 14400end

On phase2 you need to specify the exact local and remote subnet in the same fashion as pfsense

So apply the following

edit "PF01 EGSI" set phase1name "PF01 EGSI

set-src-addr-type subnet

set dst-addr-type subnet

set src-subnet 192.168.211.0/24 set dst-subnet 192.168.231.0/24

set keylifeseconds 8800

end

And optionally I would not run dhgrp2 but use dhgrp5 or better.

ken

amatteo78Author

New Member

emnoc wrote:
Here's what you need todo;

on the phase1 at the fortigte unset and disable the following;

edit "PF01 EGSI"
    set mode-cfg disable
    set keylife 14400end

On phase2 you need to specify the exact local and remote subnet in the same fashion as pfsense
So apply the following

edit "PF01 EGSI"        set phase1name "PF01 EGSI
        set-src-addr-type subnet
        set dst-addr-type subnet
        set src-subnet 192.168.211.0/24        set dst-subnet 192.168.231.0/24
       set keylifeseconds 8800
end

And optionally I would not run dhgrp2 but use dhgrp5 or better.

ken

On Phase 2... I try do change you suggest, but after I do "show" and see same before....

edit "PF01 EGSI" set phase1name "PF01 EGSI" set keylifeseconds 8800 set src-subnet 192.168.211.0 255.255.255.0 set dst-subnet 192.168.231.0 255.255.255.0

mmishra_FTNTAnswer

Staff

Hello,

"ignoring ike request, no policy configured" usually suggests firewall policy missing for Virtual IPSEC interface.

You might want to cross check firewall policies on Fortigate, there should be following two polices configured:

1>IPSEC virtual interface -> Internal interface (Where network for which traffic is to be send over VPN is connected)

2>Internal interface -> IPSEC virtual interface

Assuming VPN configured are in interface mode

emnoc

New Member

Also don't forget about policies on the pfsense side

pfctl -s rule | grep ike

pfctl -s rule | grep esp

Make sure you correct the phase1-cfg as suggested b4.

ken

Iescudero

New Member

Hi Everyone!!

you got enable DPD in your PfSense and disabled in your Fortigate, i bet thats why is not working!

try to change it, and let both sides with equal config.

Let us know if it helps.

Bye!

Iescudero

New Member

Also disable "auto-negotiate enable" in IKE Phase2 in the Fortigate Side.

amatteo78Author

New Member

Hello,

thanks to yours reply, I try and come back update you.

M.

amatteo78Author

New Member

Hello,

I solve, the problem is I don't set firewall rule on Fortigate, I mean from local to remote network. I think I can do after tunnel up only to flow traffic.

Thanks to all for helps

M.

emnoc

New Member

FWIW

auto-negotiate enable will not keep a vpn tunnel from coming up. It actually helps with automatica tunnel setup when interesting traffic is to encrypted.

For dpd yes the pfsense uses cisco dpd in the initial contact, but that also will not keep a tunnel from coming up either. typically if they follow cisco DPD which I think they do, the side that starts the conservation and has DPD enable will send attempt DPD only if the peer accepts and sends RU-THERE-ACKs

Once again, I don't think that's a issues at this point, since his phase1 errors so no acceptable policies.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded