Technical Tip: IPsec Not Match Local Policy

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 215368

Description

This article describes that tunnel fails to come up with 'Peer SA proposal not match local policy' message in logs.

Scope

FortiGate.

Solution

The VPN configuration is identical on both local and remote ends but the VPN still fails to come up and negotiation errors are seen in the logs.

This is often because of a missing FW policy Inbound/Outbound for the tunnel.

Creating the respective policy should make the negotiation successful.

It is possible to gather additional information about the negotiations using the following debugs:

diagnose vpn ike log-filter dst-addr4 (X.X.X.X) <----- IP address of the remote peer.

diagnose debug application ike -1

diagnose debug enable

Note:

Starting from v7.4.1, the 'diagnose vpn ike log-filter dst-addr4' command has been changed to 'diagnose vpn ike log filter rem-addr4'.

60234

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.