IPSec VPN problem

[Abhay_Dubey]

configured the IPSec Hub & Spoke Config but its not enabling. when monitoring the IPSec activity & it showed pri=error , vpn_tunnel=unknown_cookies . I am configuring this over ddns. thanks & regards Abhay

[#2]

Write down the steps that you did, and we' ll look them over. -gsgi

[Abhay_Dubey]

HUB_HUB config vpn ipsec phase1 edit " AAK" set type ddns set interface " wan1" set dpd enable set nattraversal enable set proposal 3des-sha1 3des-md5 set peertype one set mode aggressive set remotegw-ddns " HOSTNAME.dyndns.org" set psksecret ENC fCAwbUS54m9PnH3pEjgh25FuSr3lCYYxdvNJ+1VI1AOeBxi4jasNHq0FiI3eRHVz4Y8RVTYDFEcMYiR8keyzgCT7iT3R2K88Am3OhRa6ztZdREBh set peerid " 105" next end config vpn ipsec phase2 edit " RAKA" set dhgrp 1 set keepalive enable set pfs enable set phase1name " AAK" set proposal 3des-sha1 3des-md5 set replay enable next end config vpn ipsec concentrator edit " CRY" set member " AAK" next end SPOKE_SPOKE config vpn ipsec phase1 edit " AXB" set type ddns set interface " external" set dpd enable set nattraversal enable set proposal 3des-sha1 3des-md5 set peertype one set mode aggressive set remotegw-ddns " HOSTNAME.dyndns.org" set psksecret ENC Db52Lwe2QZU+nxBzbnLSMDulE+Oa5eJBtO3Z2uuHAndgZzSdPV72tSRbniH80sGuUExjX+jwfqhQlLL+Y0Z/nGkFJZ4rjwSymuzppsyInWNyOiDd set peerid " 105" next end config vpn ipsec phase2 edit " DXA" set dhgrp 1 set keepalive enable set pfs enable set phase1name " AXB" set proposal 3des-sha1 3des-md5 set replay enable next end thats the config

[#4]

ok, and you are sure the dyndns settings are working, because I messed mine up. (i put in the wrong username and thought the fortinet wasn' t updating my ddns.) so when you ping the ddns names you are getting the correct ips back, right? thanks, gsgi

[Abhay_Dubey]

Rechecked the DYNDNS Settings & PING Reply. Thats very much correct & latency is also low. thus it should not be speed related issue. Thanks & Regards Abhay Dubey

[#6]

Which forti OS are you using? Is it important that you use peer id? Why are you using aggressive mode instead of main mode? Do you care if you use an interface mode ipsec, vs a route-policy based ipsec between the two routers? How many tunnels are you establishing on these fortinets? Reason I ask is because if you just want one, then interface mode is probably easier. In training they #1 problem was a mismatched secret key, enter them both again and check. Finally do you have a fw policy on both routers, from Ext to Int I think, with IPSEC chosen as the action? -gsgi