Troubleshooting Tip: IKE negotiation error between...

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 342645

Description

This article describes how to deal with the IKE negotiation error between FortiGate and Sonicwall.

Scope

FortiOS v7.

Solution

CLI commands:

diagnose debug reset
diagnose vpn ike log filter clear
diagnose vpn ike log filter name "IPsec_Tunnel_Name"
diagnose debug application ike -1
diagnose debug enable

If the IKE debug message contains the error 'probable pre-shared secret mismatch'.

Solution:
Check if the 'Peer ID' on FortiGate matches the 'Local IKE ID' on Sonicwall.

On FortiGate:

On Sonicwall:

If the IKE debug message contains a 'malformed responder cookie'.

Solution: (If FortiGate is behind the NAT device).
Check if the 'Peer IKE ID' configured on Sonicwall is the IPv4 interface IP of FortiGate connected to the uplink device.

On FortiGate:

On Sonicwall:

227

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Troubleshooting Tip: IKE negotiation error between FortiGate and Sonicwall