Troubleshooting Tip: IPsec connection fails to progress at DH secret creation due to IKECRYPT Daemon Crash on FortiGate

[bgovindaraj]

Description	This article describes an issue where the IPsec connection does not establish and fails at creating the DH shared secret due to the ikecrypt daemon crash.
Scope	FortiOS 7.0 and onwards.
Solution	An intermittent or continuous crash of the IKECRYPT daemon can prevent the IPSec VPN connection from being established, as the Diffie-Hellman (DH) shared secret calculation relies on the normal operation of the IKECRYPT daemon. ike V=root:0:eb5a3329d5007645/0000000000000000:287: SA proposal chosen, matched gateway Test_IPsec ike V=root:0:Test_IPsec:Test_IPsec: created connection: 0x9a00330 5 24.32.97.69->47.223.57.89:500. ike V=root:0:Test_IPsec:287: processing notify type NAT_DETECTION_SOURCE_IP ike V=root:0:Test_IPsec:287: processing NAT-D payload ike V=root:0:Test_IPsec:287: NAT detected: PEER ike V=root:0:Test_IPsec:287: process NAT-D ike V=root:0:Test_IPsec:287: processing notify type NAT_DETECTION_DESTINATION_IP ike V=root:0:Test_IPsec:287: processing NAT-D payload ike V=root:0:Test_IPsec:287: NAT detected: PEER ike V=root:0:Test_IPsec:287: process NAT-D ike V=root:0:Test_IPsec:287: FEC vendor ID received FEC but IP not set ike 0:Test_IPsec:287: FCT EAP 2FA extension vendor ID received ike V=root:0:Test_IPsec:287: responder preparing SA_INIT msg ike V=root:0:Test_IPsec:287: generate DH public value request queued ike V=root:0:Test_IPsec:287: IKEv2 phase1 DH failed <----- ike V=root:0:Test_IPsec:287: schedule delete of IKE SA eb5a3329d5007645/a1b50b1f4b77cedc ike V=root:0:Test_IPsec:287: scheduled delete of IKE SA eb5a3329d5007645/a1b50b1f4b77cedc The ikecryptd process ID may be seen constantly changing indicating frequent crashes and without a trace in the output of 'diagnose debug crashlog read'. FortiGate-40F # diagnose sys process pidof ikecryptd 15164 FortiGate-40F # diagnose sys process pidof ikecryptd 15171 FortiGate-40F # diagnose sys process pidof ikecryptd 15177 This issue may occur when the FortiGate device is running low on system memory. Ensure that the device has sufficient free memory and is not entering conserve mode. For memory optimization recommendations, refer to the following articles: Technical Tip: FortiGate is entering into Conserve Mode during FortiGuard Updates Technical Tip: How to optimize memory consumption for smaller FortiGates Technical Tip: Free up memory to avoid conserve mode Workaround: Disable dh-multiprocess from 'config system ike' to shift the DH Secret Creation task from ikecryptd to ike daemon. Note: The Ikecryptd daemon is used to improve performance and overall IPsec tunnel setup rate by moving expensive DH calculations out of the single iked process and into separate ikecryptd processes, which can more effectively use multiple CPUs.