Troubleshooting Tip: IPsec error 22: Invalid argument

[kcheng]

Description	This article describes how to troubleshoot IPsec error 22: Invalid argument.
Scope	FortiGate.
Solution	In this example, the IPsec Tunnel is configured between FG-A and FG-B with the following Phase2 selector setting: FG-A: [IPSec_local]. IPSec_local_subnet_1: 10.251.0.0/20. IPSec_local_subnet_2: 10.251.0.0/24. [IPSec_remote]. IPSec_remote_subnet_1: 10.120.0.0/20. FG-B: [IPSec_local]. IPSec_local_subnet_1: 10.120.0.0/20. [IPSec_remote]. IPSec_remote_subnet_1: 10.251.0.0/20. IPSec_remote_subnet_2: 10.251.0.0/24. IPsec phase2 is not coming up with the respective configuration if the IPsec tunnel is brought up from FG-B. Furthermore, inspection is performed by examining the IPsec debug logs with the following command: diagnose vpn ike log-filter dst-addr4 <remote_IP> diagnose debug application ike -1 diagnose debug enable Note: Starting from FortiOS v7.4.1, the 'diagnose vpn ike log-filter dst-addr4' command has been changed to 'diagnose vpn ike log filter rem-addr4'. To stop the debugging, run the following commands: diagnose debug disable diagnose debug reset From the debug log, it is possible to see that FG-A failed to add SA with error 22: Invalid argument:                                               It was also observed from FG-A that the SA_DONE operation failed with error 2: No such file or directory: The tunnel can be established should the FG-A become the initiator: FG-A: FG-B: This happens due to the overlapping IP address subnet configured on FG-A. Removing 10.251.0.0/24 from the address group on both FortiGates would prevent the IPsec tunnel issue regardless of whether FG-A or FG-B becomes the initiator. Note: Additionally, the command 'diagnose vpn tunnel list name <name>' can be used to quickly identify overlapping subnets within the phase-2 settings. This output provides a detailed breakdown of all source and destination ranges associated with the tunnel. Example output: proxyid=IPSec-Tunnel proto=0 sa=0 auto-negotiate src: 0:192.168.180.4-192.168.180.4:0 0:192.168.180.5-192.168.180.5:0 0:172.29.140.0-172.29.140.255:0 dst: 0:172.25.0.0-172.25.255.255:0 0:172.25.15.11-172.25.15.11:0 0:172.25.30.9-172.25.30.9:0 0:10.243.6.100-10.243.6.100:0 It is visible that the '172.25.0.0/16' subnet overlaps with '172.25.x.x' addresses.