VPN IPSec ignoring IKEv2 request, no policy configured

Forum|Forum|1 year ago
May 15, 2025
1 reply
1984 views

Hello team,

I have configured VPN IPSec from PA to FGT but the pahse1 still down.

I have enabled the debug from fortigate's CLI and following the results:

debug commands:

diag debug reset
diag debug console timestamp enable
diag debug application ike -1
diag debug enable

debug output:

ignoring IKEv2 request, no policy configured

The peer from FGT is a public ip configured on WAN interface directly.

Do you have any suggestions?

Thanks for the support

BR

Best answer by funkylicious

you would need to configure firewall rules with source interface or destination interface, the IPsec tunnel and whatever internal interface you would need to access/be access and could leave source/destination address any and service all.

you could read this documentation on how to create an ipsec tunnel, https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/913287/basic-site-to-site-vpn-with-pre-shared-key

https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/806643/vpn-security-policies

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IKE-error-no-policy-configured/ta-p/293044

funkylicious

SuperUser

do you have firewall policies for the traffic / routes for the tunnel ?

"jack of all trades, master of none"

luca1994Author

Explorer III

Hello @funkyliciousm,

i don't have any policies for traffic IKE. I need configure witch type of policy?

In this way?

config firewall policy
edit n
set name "vpn-test"
set srcintf "WAN"
set dstintf "WAN"
set srcaddr "remote peer"
set dstaddr "FGT peer"
set action accept
set schedule always
set service IKE
set logtraffic all
next
end

Thanks