Debug message showing: Ignoring request ...

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 240795

Description

This article describes the issue where VPN phase 1 is not coming up for a route-based VPN and the debug logs are showing the message:

'ignoring request to establish IPsec SA, gateway is in passive mode'.

Scope

FortiGate 6.2, 6.4, 7.0, 7.2.

Solution

Disable passive mode in VPN phase 1 setting.

Follow the steps given below:

# config vpn ipsec phase1-interface
edit phase-1-name <----- Tunnel name.
set passive-mode disable
end

This setting makes the FortiGate a Responder and will ignore any IKE request if it is being initiated by the FortiGate.

1355

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Technical Tip: Debug message showing: Ignoring request to establish IPsec SA, gateway is in passive mode

You are leaving our website