Can somebody help me debugging ?

[guygox]

Hi, I try to establish a site to site vpn with a Fortigate 200D. According to the logs Phase1 seems to succeed. But I can' t make it work. So I tried debug command, but I don' t understand where does the problem comes from. Here are my debugging messages : Thank you !!!

 ike 0:GPD:4017:         type=OAKLEY_HASH_ALG, val=MD5.
  
 ike 0:GPD:4017:         type=AUTH_METHOD, val=PRESHARED_KEY.
  
 ike 0:GPD:4017:         type=OAKLEY_GROUP, val=1024.
  
 ike 0:GPD:4017: ISAKMP SA lifetime=3600
  
 ike 0:GPD:4017: out C1F8360992B41100934A3C3A65528B340410020000000000000000B40A0000841F6A5FE3EB403811C8F8D244A1ABD25D382274DAE10080A54484B151D7EB15B6D52E7163DFAD10A9363E2E745DB1B86C7D749B5F4A83E755F7B0526E3CB8EE98E9BFE7E78B2FEBFB05D18CDDB325F7EC0DFF93C636CB389E09CEA6B959648044346237A6EBECEFBE896F6D6C4F2C25957923B4CFB0B0F0158E0CCEFFB660ABB300000014FB83C2E1AF32848ED085F470E2689DAA
  
 ike 0:GPD:4017: sent IKE msg (ident_i2send): 27.18.14.69:500->27.19.29.29:500, len=180, id=c1f8360992b41100/934a3c3a65528b34
  
 ike 0: comes 27.19.29.29:500->27.18.14.69:500,ifindex=7....
  
 ike 0: IKEv1 exchange=Identity Protection id=c1f8360992b41100/934a3c3a65528b34 len=180
  
 ike 0: in C1F8360992B41100934A3C3A65528B340410020000000000000000B40A00008400FCB21F258AD6537E0EF781FB2637E639D472F20A7FCAEC3712209BA29819C08B2CAECF900B2AC497D6C1A3C877EB1502637D8E89F09190E627107E73022FD0794102B1A76289AA097C47D9E3F9CD99F8ADD61021FCC96F55082BF9CB291B6468B6973A86B47D82C07573205A0CC5D8379C9D37A7992DF7FCE1F42B82F926000000014A0F949A8121C221B3B6D488DCC6097A9
  
 ike 0:GPD:4017: initiator: main mode get 2nd response...
  
 ike 0:GPD:4017: ISAKMP SA c1f8360992b41100/934a3c3a65528b34 key 8:38322DB0640A8FBE
  
 ike 0:GPD:4017: add INITIAL-CONTACT
  
 ike 0:GPD:4017: enc C1F8360992B41100934A3C3A65528B340510020100000000000000580800000C01000000D96CAE450B000014EFB42706A7F89B14716A2F28B9162BA0000001C0000000101106002C1F8360992B41100934A3C3A65528B34
  
 ike 0:GPD:4017: out C1F8360992B41100934A3C3A65528B3405100201000000000000005C4094F1167B9E66EF4248ACA24DD70612F46B2ABE03DAF8255A428D4262B908DA0D41DAB8A988D54C924D4B69101A905AC406AB74E84BDC96DF0D5817D0ED471B
  
 ike 0:GPD:4017: sent IKE msg (ident_i3send): 27.18.14.69:500->27.19.29.29:500, len=92, id=c1f8360992b41100/934a3c3a65528b34
  
 ike 0: comes 27.19.29.29:500->27.18.14.69:500,ifindex=7....
  
 ike 0: IKEv1 exchange=Identity Protection id=c1f8360992b41100/934a3c3a65528b34 len=68
  
 ike 0: in C1F8360992B41100934A3C3A65528B340510020100000000000000442BB47119EF34430DC59D4FDD224E8A2250B6BE9C1E4162C724FFE03F71BE9971B22C5913BB789196
  
 ike 0:GPD:4017: initiator: main mode get 3rd response...
  
 ike 0:GPD:4017: dec C1F8360992B41100934A3C3A65528B340510020100000000000000440800000C011101F4D96D1DE500000014F026B7446612046127EFC83D75221523F9C2E99A809AFF07
  
 ike 0:GPD:4017: PSK authentication succeeded
  
 ike 0:GPD:4017: authentication OK
  
 ike 0:GPD:4017: established IKE SA c1f8360992b41100/934a3c3a65528b34
  
 ike 0:GPD: set oper up
  
 ike 0:GPD: schedule auto-negotiate
  
 ike 0:GPD:4017: no pending Quick-Mode negotiations
  
 ike 0:GPD: carrier up
  
 exit 
 

[ede_pfau]

Looks to me that there' s no phase2 attached at all, not only a mismatched phase2 parameter. Could you post the phase2 settings, of both sides? QM selectors are significant, I wouldn' t use 0.0.0.0/0 at all.

[guygox]

Which command should I use to display that. I cannot have logs on the other side. I cannot acces the Equipment.

[emnoc]

For starters you could execute any one of the following; show vpn ipsec phase2 or show vpn ipsec phase2-interface Depending on if you did the recommend interface mode or not Also you can follow my blog and the thread that I created specifically with diagnostics of a site2site vpn here. http://socpuppet.blogspot.com/2013/10/site-2-site-routed-vpn-trouble-shooting.html It' s mainly fortigate specific but the same concepts applies regardless of the vpn device. Also if you could post what the other side vpn device type ( fortigate, juniper, openswan,asa,etc..... ) We could better assist you in t-shooting and/or diagnostics & what to request from the other firewall admins.