Skip to main content
Tistopher
Tistopher
New Member
November 16, 2020
Question

VPN's Will not come up. Looked through all settings FortiGate > Draytek Vigor

  • November 16, 2020
  • 10 replies
  • 11410 views

Hello Guys,

 

Hopefully someone can help!, I have tried NAT-T on and off doesn't do any joy. DPD is disabled. See below config of VPN on FortiGate side, the PSK is definately correct I've reset it loads of times. Basically I just se "sent IKE msg (P1_RETRANSMIT) all the time then the tunnel deletes the connection and resets and goes again. At first I though this might be an issue since both sides do not have static IP's (Only DDNS) - however I tried just to put the IP in that each side currently has and the same issue happens:

 

Config Below:

config vpn ipsec phase1-interface

    edit "VPN-House"         set type ddns         set interface "wan1"         set peertype any         set net-device disable         set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1         set dpd disable         set dhgrp 2         set remotegw-ddns "someonesDDNS.org"         set psksecret ENC fc2ZqgrLrWOa/CsEj1iW77PkPWytlmFMwe7eJD719tHfrVfyOZmtXQaQkPkh8u1Cc0R5pEciDmlNFCj4pLnRVwHe/JrHjvkcqIkJv2dmGBtE+fw/vtYDhFqWQ/OdOGPME+1WA4hfai8nUIuupQZPpQ2cZsY1DFdoYrPUP7EMy7Uu8ZKNvtykvfUN/1TbHE3Pty2vUA==     next

config vpn ipsec phase2-interface

    edit "VPN-House"         set phase1name "VPN-House"         set proposal aes128-sha1 aes128-md5         set pfs disable         set replay disable         set keylifeseconds 3600         set src-subnet 172.16.10.0 255.255.255.0         set dst-subnet 172.16.32.0 255.255.255.0     next

 

Debugging Below:

ike 0:VPN-House reset tunnel remote gw X.X.X.X ike 0:VPN-House: schedule auto-negotiate ike 0:VPN-House: deleted ike 0:VPN-House: set oper down ike 0: cache rebuild start ike 0:VPN-House: sending DNS request for remote peer someonesDDNS.org ike 0: send IPv4 DNS query : someonesDDNS.org ike 0:User-VPN: cached as dynamic ike 0: cache rebuild done ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0:VPN-House: sending DNS request for remote peer someonesDDNS.org ike 0: send IPv4 DNS query : someonesDDNS.org ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0:VPN-House: sending DNS request for remote peer someonesDDNS.org ike 0: send IPv4 DNS query : someonesDDNS.org ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0: DNS response received for remote gateway someonesDDNS.org ike 0: DNS someonesDDNS.org -> X.X.X.X ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0:VPN-House: sending DNS request for remote peer someonesDDNS.org ike 0: send IPv4 DNS query : someonesDDNS.org ike 0: DNS response received for remote gateway someonesDDNS.org ike 0: DNS someonesDDNS.org -> X.X.X.X ike 0:VPN-House: 'someonesDDNS.org' resolved to X.X.X.X ike 0:VPN-House: set remote-gw X.X.X.X ike 0: cache rebuild start ike 0:VPN-House: local:X.X.X.X, remote:X.X.X.X ike 0:VPN-House: cached as static-ddns. ike 0:User-VPN: cached as dynamic ike 0: cache rebuild done ike 0:VPN-House: auto-negotiate connection ike 0:VPN-House: created connection: 0x57ff2a8 6 X.X.X.X->X.X.X.X:500. ike 0:VPN-House:126: initiator: main mode is sending 1st message... ike 0:VPN-House:126: cookie 314993691d73b8a8/0000000000000000 ike 0:VPN-House:126: out 314993691D73B8A8000000000000000001100200000000000000019C0D0000B40000000100000001000000A8010100040300002801010000800B0001000C00040001518080010007800E00808003000180020004800400020300002802010000800B0001000C00040001518080010007800E01008003000180020004800400020300002803010000800B0001000C00040001518080010007800E00808003000180020002800400020000002804010000800B0001000C00040001518080010007800E01008003000180020002800400020D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:VPN-House:126: sent IKE msg (ident_i1send): X.X.X.X:500->X.X.X.X:500, len=412, id=314993691d73b8a8/0000000000000000 ike 0:VPN-House:126: out 314993691D73B8A8000000000000000001100200000000000000019C0D0000B40000000100000001000000A8010100040300002801010000800B0001000C00040001518080010007800E00808003000180020004800400020300002802010000800B0001000C00040001518080010007800E01008003000180020004800400020300002803010000800B0001000C00040001518080010007800E00808003000180020002800400020000002804010000800B0001000C00040001518080010007800E01008003000180020002800400020D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:VPN-House:126: sent IKE msg (P1_RETRANSMIT): X.X.X.X:500->X.X.X.X:500, len=412, id=314993691d73b8a8/0000000000000000 ike 0:VPN-House:126: out 314993691D73B8A8000000000000000001100200000000000000019C0D0000B40000000100000001000000A8010100040300002801010000800B0001000C00040001518080010007800E00808003000180020004800400020300002802010000800B0001000C00040001518080010007800E01008003000180020004800400020300002803010000800B0001000C00040001518080010007800E00808003000180020002800400020000002804010000800B0001000C00040001518080010007800E01008003000180020002800400020D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:VPN-House:126: sent IKE msg (P1_RETRANSMIT): X.X.X.X:500->X.X.X.X:500, len=412, id=314993691d73b8a8/0000000000000000 ike 0:VPN-House:126: out 314993691D73B8A8000000000000000001100200000000000000019C0D0000B40000000100000001000000A8010100040300002801010000800B0001000C00040001518080010007800E00808003000180020004800400020300002802010000800B0001000C00040001518080010007800E01008003000180020004800400020300002803010000800B0001000C00040001518080010007800E00808003000180020002800400020000002804010000800B0001000C00040001518080010007800E01008003000180020002800400020D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:VPN-House:126: sent IKE msg (P1_RETRANSMIT): X.X.X.X:500->X.X.X.X:500, len=412, id=314993691d73b8a8/0000000000000000 ike 0:VPN-House:126: negotiation timeout, deleting ike 0:VPN-House: connection expiring due to phase1 down ike 0:VPN-House: deleting ike 0:VPN-House reset tunnel remote gw X.X.X.X ike 0:VPN-House: schedule auto-negotiate ike 0:VPN-House: deleted ike 0:VPN-House: set oper down ike 0: cache rebuild start ike 0:VPN-House: sending DNS request for remote peer someonesDDNS.org ike 0: send IPv4 DNS query : someonesDDNS.org ike 0:User-VPN: cached as dynamic ike 0: cache rebuild done ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0: DNS response received for remote gateway someonesDDNS.org ike 0: DNS someonesDDNS.org -> X.X.X.X ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0:VPN-House: 'someonesDDNS.org' resolved to X.X.X.X ike 0:VPN-House: set remote-gw X.X.X.X ike 0: cache rebuild start ike 0:VPN-House: local:X.X.X.X, remote:X.X.X.X ike 0:VPN-House: cached as static-ddns. ike 0:User-VPN: cached as dynamic ike 0: cache rebuild done ike 0:VPN-House: auto-negotiate connection ike 0:VPN-House: created connection: 0x57ff2a8 6 X.X.X.X->X.X.X.X:500. ike 0:VPN-House:127: initiator: main mode is sending 1st message... ike 0:VPN-House:127: cookie 352ad45f8151c5d0/0000000000000000 ike 0:VPN-House:127: out 352AD45F8151C5D0000000000000000001100200000000000000019C0D0000B40000000100000001000000A8010100040300002801010000800B0001000C00040001518080010007800E00808003000180020004800400020300002802010000800B0001000C00040001518080010007800E01008003000180020004800400020300002803010000800B0001000C00040001518080010007800E00808003000180020002800400020000002804010000800B0001000C00040001518080010007800E01008003000180020002800400020D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:VPN-House:127: sent IKE msg (ident_i1send): X.X.X.X:500->X.X.X.X:500, len=412, id=352ad45f8151c5d0/0000000000000000 Home-FortiWiFi # diike 0:VPN-House:127: out 352AD45F8151C5D0000000000000000001100200000000000000019C0D0000B40000000100000001000000A8010100040300002801010000800B0001000C00040001518080010007800E00808003000180020004800400020300002802010000800B0001000C00040001518080010007800E01008003000180020004800400020300002803010000800B0001000C00040001518080010007800E00808003000180020002800400020000002804010000800B0001000C00040001518080010007800E01008003000180020002800400020D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000

 

Thanks,

Chris

 

10 replies

emnoc
emnoc
New Member
November 16, 2020

The problem is obvious   based on the following 

 

"ike 0:VPN-House:126: negotiation timeout, deleting"

 

So you sent to some address/name and no reply is that device ( remote-gw) correct? Humor me, have some give you the public-address that that the suspect dyndns item is using, put that into you cfg. Do you get a reply?

 

NAT-T and DPD is not the issue at this point. You need to explore why the device x.x.x.x:500 did not reply.

 

Ken Felix

 

ede_pfau
SuperUser
ede_pfau
SuperUser
November 16, 2020

hi,

 

you can see that one of the firewalls (the FGT) is behind a NAT device, as traffic switches to udp/500. Make sure the Draytek can handle NAT-T (NAT traversal).

And I'm not sure the Draytek supports SHA256, I'd try the lowest available setting until the VPN is up.

rwpatterson
rwpatterson
New Member
November 16, 2020

Also on the Fortigate side, you will need to create at least one policy that leverages that tunnel before anything will happen.

Tistopher
TistopherAuthor
New Member
November 16, 2020

Cheers Guys,

 

This tunnel used to work till I moved house, The Policies are in place a long with the static route to other end's subnet. I can see yes now that it times out. I have looked on the Draytek side and AES128-SHA1 DIFF 14.

 

It resolves the correct DDNS IP as I can see that through the capture. Unfortunately Drayteks don't offer very good troubleshooting. My only other guess is to update the Draytek's firmware....

 

Something I thought I shouldn't have to do, other than that the config is pretty simple, I havn't enabled PFS Draytek side so disabled it FortiGate side.

 

I just rebooted both devices to see if it would make a difference and it doesn't :\

Cheers,

Chris

Terms & ConditionsAccessibility statement
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!