Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
tdhaslett
New Contributor

Avaya Phone Set VPN Connection Issue

Hi All,

We are trying to move the VPN connection for our Avaya phone sets for remote workers off of our old Cisco ASA over to our Fortigate 200D HA pair. I am having trouble getting it to connect.

[ul]
  • Firmware is 6.0.12 b0419
  • We are using the built-in VPN client in the phones. No intermediate VPN devices.
  • I am testing with a 9611G set.
  • Our phones connect using H.323.
  • CM is 8.1.[/ul]

    I am able to get the phone to establish IKE Phase 1, but I get "IKE Phase 2 no response" on the phone set. VPN Event log agrees with this. XAUTH is successful. The phone set gets an IP address from the configured range, but I get a Status of failure and Result of ERROR in the log.

    When I run "diag vpn tunnel list name tunnelname", the last line I get is the one that starts with "natt". The guide I'm looking at says that I need to look at the value of "sa=X", which would be on the next line, so I don't know where to go from here.

    name=Avaya_VPN_3 ver=1 serial=771 XXX.XXX.XXX.XXX:XXXX->XXX.XXX.XXX.XXX:XXXXX bound_if=7 lgwy=static/1 tun=intf/0 mode=dial_inst/3 encap=none/392 options[0188]=npu rgwy-chg rport-chg  parent=Avaya_VPN index=3 proxyid_num=0 child_num=0 refcnt=5 ilast=27 olast=27 ad=/0 stat: rxp=0 txp=0 rxb=0 txb=0 dpd: mode=on-idle on=1 idle=60000ms retry=3 count=0 seqno=135 natt: mode=silent draft=32 interval=10 remote_port=12162

    I have verified, re-verified, re-re-verified and then checked again to make sure that my encryption and auth protocols and DH groups match. Could this be a problem with my local/remote address selectors? I have the local set to an Address Group that contains the subnets we use on our LAN, and the remote is set to the DHCP range that the phones will get.

     

    Any guidance would be appreciated!

  • 1 REPLY 1
    GDiFi
    Staff
    Staff

    If you run the following debug you can verify the phase2 negotiation and see what the phone is looking for in its proposal.  The Address types (subnet vs range vs named address) selected can sometimes not work with certain devices.

     

    # diagnose debug console timestamp enable  
    # diagnose debug application Ike -1
    # diagnose debug enable 

    Announcements

    Select Forum Responses to become Knowledge Articles!

    Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

    Labels
    Top Kudoed Authors