Can't seem to get site-to-site IPSEC VPN to work?

[Pablo_Mosca]

Main office (100A  - v4.0,build0324,110520 (MR2 Patch 7)) -- Yes I know it is old.

Branch office (60C - v5.2.13,build762 (GA)

I have setup the site-to-site VPN on both.. 100% sure the settings are matching on both sides.

Could it be that the 100A is just too old? I can't update the firmware of course since it is so old and out of service.

I think the issue is at the branch firewall.. both debug logs below. maybe this -- mode-cfg missing INTERNAL_IP4_ADDRESS?

Here is what I am getting..

ation ike -1ike 0: comes 67.78.211.86:500->66.133.218.42:500,ifindex=2.... ike 0: IKEv1 exchange=Identity Protection id=bcd777f0321da541/0000000000000000 len=288 ike 0:SanAntonio_Dallas: new connection. ike 0:SanAntonio_Dallas:591: responder: main mode get 1st message... ike 0:SanAntonio_Dallas:591: VID RFC 3947 4A131C81070358455C5728F20E95452F ike 0:SanAntonio_Dallas:591: VID draft-ietf-ipsec-nat-t-ike-03 7D9419A65310CA6F2C179D9215529D56 ike 0:SanAntonio_Dallas:591: VID draft-ietf-ipsec-nat-t-ike-02 CD60464335DF21F87CFDB2FC68B6A448 ike 0:SanAntonio_Dallas:591: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F ike 0:SanAntonio_Dallas:591: VID draft-ietf-ipsec-nat-t-ike-01 16F6CA16E4A4066D83821A0F0AEAA862 ike 0:SanAntonio_Dallas:591: VID draft-ietf-ipsec-nat-t-ike-00 4485152D18B6BBCD0BE8A8469579DDCC ike 0:SanAntonio_Dallas:591: VID DPD AFCAD71368A1F1C96B8696FC77570100 ike 0:SanAntonio_Dallas:591: DPD negotiated ike 0:SanAntonio_Dallas:591: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3 ike 0:SanAntonio_Dallas:591: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3C0000000 ike 0:SanAntonio_Dallas:591: VID unknown (16): 8299031757A36082C6A621DE00000000 ike 0:SanAntonio_Dallas:591: negotiation result ike 0:SanAntonio_Dallas:591: proposal id = 1: ike 0:SanAntonio_Dallas:591: protocol id = ISAKMP: ike 0:SanAntonio_Dallas:591: trans_id = KEY_IKE. ike 0:SanAntonio_Dallas:591: encapsulation = IKE/none ike 0:SanAntonio_Dallas:591: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:SanAntonio_Dallas:591: type=OAKLEY_HASH_ALG, val=SHA. ike 0:SanAntonio_Dallas:591: type=AUTH_METHOD, val=PRESHARED_KEY. ike 0:SanAntonio_Dallas:591: type=OAKLEY_GROUP, val=1536. ike 0:SanAntonio_Dallas:591: ISKAMP SA lifetime=28800 ike 0:SanAntonio_Dallas:591: selected NAT-T version: RFC 3947 ike 0:SanAntonio_Dallas:591: cookie bcd777f0321da541/d2c60061c09565d2 ike 0:SanAntonio_Dallas:591: sent IKE msg (ident_r1send): 66.133.218.42:500->67.78.211.86:500, len=124 ike 0: comes 67.78.211.86:500->66.133.218.42:500,ifindex=2.... 1 exchange=Identity Protection id=bcd777f0321da541/d2c60061c09565d2 len=292 ike 0: found SanAntonio_Dallas 66.133.218.42 2 -> 67.78.211.86:500 ike 0:SanAntonio_Dallas:591: responder:main mode get 2nd message... ike 0:SanAntonio_Dallas:591: NAT not detected ike 0:SanAntonio_Dallas:591: sent IKE msg (ident_r2send): 66.133.218.42:500->67.78.211.86:500, len=292 ike 0:SanAntonio_Dallas:591: ISAKMP SA bcd777f0321da541/d2c60061c09565d2 key 24:5CEDBCB0568999CF6FD2C8E083B45254CE01CE32B542DB76 ike 0: comes 67.78.211.86:500->66.133.218.42:500,ifindex=2.... ike 0: IKEv1 exchange=Identity Protection id=bcd777f0321da541/d2c60061c09565d2 len=108 ike 0: found SanAntonio_Dallas 66.133.218.42 2 -> 67.78.211.86:500 ike 0:SanAntonio_Dallas:591: responder: main mode get 3rd message... ike 0:SanAntonio_Dallas:591: received notify type 24578 ike 0:SanAntonio_Dallas:591: PSK authentication succeeded ike 0:SanAntonio_Dallas:591: authentication OK ike 0:SanAntonio_Dallas:591: sent IKE msg (ident_r3send): 66.133.218.42:500->67.78.211.86:500, len=76 ike 0:SanAntonio_Dallas:591: established IKE SA bcd777f0321da541/d2c60061c09565d2 ike 0:SanAntonio_Dallas:591: processing INITIAL-CONTACT ike 0:SanAntonio_Dallas: flushing ike 0:SanAntonio_Dallas: flushed ike 0:SanAntonio_Dallas:591: processed INITIAL-CONTACT ike 0:SanAntonio_Dallas:591: no pending Quick-Mode negotiations ike 0: comes 67.78.211.86:500->66.133.218.42:500,ifindex=2.... ike 0: IKEv1 exchange=Mode config id=bcd777f0321da541/d2c60061c09565d2:8bc6569a len=124 ike 0: found SanAntonio_Dallas 66.133.218.42 2 -> 67.78.211.86:500 ike 0:SanAntonio_Dallas:591: mode-cfg type 7 request 47:'466F727469476174652D3630432076352E322E31332C6275696C6430373632623736322C3137313231322028474129' ike 0:SanAntonio_Dallas:591: mode-cfg received APPLICATION_VERSION FortiGate-60C v5.2.13,build0762b762,171212 (GA) ike 0:SanAntonio_Dallas:591: mode-cfg send APPLICATION_VERSION 'Fortigate-100A v4.00.7,build0324b324,110520' ike 0:SanAntonio_Dallas:591: mode-cfg type 1 request 0:'' ike 0:SanAntonio_Dallas:591: mode-cfg not enabled, ignoring Configuration Method Request ike 0:SanAntonio_Dallas:591: mode-cfg type 2 request 0:'' ike 0:SanAntonio_Dallas:591: mode-cfg not enabled, ignoring Configuration Method Request ike 0:SanAntonio_Dallas:591: mode-cfg type 13 request 0:'' ike 0:SanAntonio_Dallas:591: mode-cfg not enabled, ignoring Configuration Method Request ike 0:SanAntonio_Dallas:591: sent IKE msg (cfg_send): 66.133.218.42:500->67.78.211.86:500, len=108 ike 0:SanAntonio_Dallas:SanAntonio_DallasTunnel: IPsec SA connect 2 66.133.218.42->67.78.211.86:500, natt_mode=0 ike 0:SanAntonio_Dallas: using existing connection, dpd_fail=0 ike 0:SanAntonio_Dallas: found phase2 SanAntonio_DallasTunnel ike 0:SanAntonio_Dallas: IPsec SA connect 2 66.133.218.42->67.78.211.86:500 negotiating ike 0:SanAntonio_Dallas:591: cookie bcd777f0321da541/d2c60061c09565d2:2fc3700d ike 0:SanAntonio_Dallas:591:SanAntonio_DallasTunnel:502: initiator selectors 0 0:192.168.100.0/255.255.255.0:0:0->0:10.6.245.0/255.255.255.0:0:0 ike 0:SanAntonio_Dallas:591: sent IKE msg (quick_i1send): 66.133.218.42:500->67.78.211.86:500, len=364 ike 0: comes 67.78.211.86:500->66.133.218.42:500,ifindex=2.... ike 0: IKEv1 exchange=Informational id=bcd777f0321da541/d2c60061c09565d2:61f07bbd len=92 ike 0: found SanAntonio_Dallas 66.133.218.42 2 -> 67.78.211.86:500 ike 0:SanAntonio_Dallas:591: recv ISAKMP SA delete bcd777f0321da541/d2c60061c09565d2 ike 0:SanAntonio_Dallas: deleting ike 0:SanAntonio_Dallas: flushing ike 0:SanAntonio_Dallas: flushed ike 0:SanAntonio_Dallas: deleted

here is the log from the branch:

ike 0:Dallas_new: schedule auto-negotiate ike shrank heap by 73728 bytes ation ike -1ike 0:Austin:2166: out 694381593ACA282A00000000000000000110020000000000000002CC0D0001E40000000100000001000001D80101000C0300002801010000800B0001000C00040001518080010007800E008080030001800200048004000E0300002802010000800B0001000C00040001518080010007800E00808003000180020004800400050300002803010000800B0001000C00040001518080010007800E010080030001800200048004000E0300002804010000800B0001000C00040001518080010007800E01008003000180020004800400050300002405010000800B0001000C0004000151808001000580030001800200048004000E0300002406010000800B0001000C000400015180800100058003000180020004800400050300002807010000800B0001000C00040001518080010007800E008080030001800200028004000E0300002808010000800B0001000C00040001518080010007800E00808003000180020002800400050300002809010000800B0001000C00040001518080010007800E010080030001800200028004000E030000280A010000800B0001000C00040001518080010007800E0100800300018002000280040005030000240B010000800B0001000C0004000151808001000580030001800200028004000E000000240C010000800B0001000C000400015180800100058003000180020002800400050D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:Austin:2166: sent IKE msg (P1_RETRANSMIT): 67.78.211.86:500->216.201.156.50:500, len=716, id=694381593aca282a/0000000000000000 ike 0:Dallas_new: auto-negotiate connection ike 0:Dallas_new: created connection: 0x24bdbc0 4 67.78.211.86->66.133.218.42:500. ike 0:Dallas_new:2186: initiator: main mode is sending 1st message... ike 0:Dallas_new:2186: cookie cfc7c7c808af2905/0000000000000000 ike 0:Dallas_new:2186: out CFC7C7C808AF290500000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00C08003000180020002800400050D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:Dallas_new:2186: sent IKE msg (ident_i1send): 67.78.211.86:500->66.133.218.42:500, len=288, id=cfc7c7c808af2905/0000000000000000 ike 0: comes 66.133.218.42:500->67.78.211.86:500,ifindex=4.... ike 0: IKEv1 exchange=Identity Protection id=cfc7c7c808af2905/a19c9eb0c30baaa7 len=124 ike 0: in CFC7C7C808AF2905A19C9EB0C30BAAA701100200000000000000007C0D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00C08003000180020002800400050D0000144A131C81070358455C5728F20E95452F00000014AFCAD71368A1F1C96B8696FC77570100 ike 0:Dallas_new:2186: initiator: main mode get 1st response... ike 0:Dallas_new:2186: VID RFC 3947 4A131C81070358455C5728F20E95452F ike 0:Dallas_new:2186: VID DPD AFCAD71368A1F1C96B8696FC77570100 ike 0:Dallas_new:2186: DPD negotiated ike 0:Dallas_new:2186: selected NAT-T version: RFC 3947 ike 0:Dallas_new:2186: negotiation result ike 0:Dallas_new:2186: proposal id = 1: ike 0:Dallas_new:2186: protocol id = ISAKMP: ike 0:Dallas_new:2186: trans_id = KEY_IKE. ike 0:Dallas_new:2186: encapsulation = IKE/none ike 0:Dallas_new:2186: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:Dallas_new:2186: type=OAKLEY_HASH_ALG, val=SHA. ike 0:Dallas_new:2186: type=AUTH_METHOD, val=PRESHARED_KEY. ike 0:Dallas_new:2186: type=OAKLEY_GROUP, val=MODP1536. ike 0:Dallas_new:2186: ISAKMP SA lifetime=28800 ike 0:Dallas_new:2186: out CFC7C7C808AF2905A19C9EB0C30BAAA70410020000000000000001240A0000C42A2DF25DA288656A85C8366ACB0CFAF5DA8779DCF51C8064D945C03CD4F0D0797F1EFFC302870A3798F947245BA388E762D7FAE7F1BFD8EA077590D26B0EF58A748E435CA9478A6BACD4D6413642C06D0C5AEA0B213347B7D5B6CF11346291E540A319B77382E38D53AB2019CB3D55DBEDBDE88D0FE05FF4F6A22A750EF706CB579097E51D91202D89D9F95EBDED74141AFA1B3890E68771C8317E3ADE0FBC467F48CA0C858C9099707B83A98623A8DB4198FCC54190A2EAA511EC16A4F20E0614000014DBDADC570E0F6D3FD0327325B7F0FCF214000018271F8F3009574200FB83B757B2047CA8E39F17940000001807E9CFB6FE1732AC43384F40A5E4095EEF29DDEC ike 0:Dallas_new:2186: sent IKE msg (ident_i2send): 67.78.211.86:500->66.133.218.42:500, len=292, id=cfc7c7c808af2905/a19c9eb0c30baaa7 ike 0: comes 66.133.218.42:500->67.78.211.86:500,ifindex=4.... ike 0: IKEv1 exchange=Identity Protection id=cfc7c7c808af2905/a19c9eb0c30baaa7 len=292 ike 0: in CFC7C7C808AF2905A19C9EB0C30BAAA70410020000000000000001240A0000C4CA2822F518AC5D020C63A1177AD0FEFF9911F45CDCA3393377D2D15E4D5A9BCA4282520B8E421442C5C3DD6F9A0E54D26CFBC2EC91F60F7C0DA8360968C6FA9F06B21EBA0786E1660BA3BFC8DEE8398C37881B5FFAA7AB0404660D52AAF73D663B479924C39CFF5D0A85ED2624AE47E05C2BB2A254373B9C1EF5F3BF715F2FE8CE014600086DE0F6B5763826430E87A7BB9D3EB1A5C62F323384DFF087836DD00EBFDB58411CC8F3241E7AD19E4749CB87EFC9B0B4AB4A321DC4C48C5104A21C1400001440F07AE25DF67590BF5419F9F75D77901400001807E9CFB6FE1732AC43384F40A5E4095EEF29DDEC00000018271F8F3009574200FB83B757B2047CA8E39F1794 ike 0:Dallas_new:2186: initiator: main mode get 2nd response... ike 0:Dallas_new:2186: NAT not detected ike 0:Dallas_new:2186: ISAKMP SA cfc7c7c808af2905/a19c9eb0c30baaa7 key 24:3BEA1CF48369AD2D57B4A426DD45FC58F43097A6F4FA8A24 ike 0:Dallas_new:2186: add INITIAL-CONTACT ike 0:Dallas_new:2186: enc CFC7C7C808AF2905A19C9EB0C30BAAA705100201000000000000005C0800000C01000000434FDD560B00001856EC8A31DD006A98E707E2CE5582EC5277FBBB9F0000001C0000000101106002CFC7C7C808AF2905A19C9EB0C30BAAA7 ike 0:Dallas_new:2186: out CFC7C7C808AF2905A19C9EB0C30BAAA705100201000000000000006C7882810C081EA25B4DC81618DDEE560AFB661BBA0A5C09619119B54E022424D141825744819BC5CB2ADE39F24F7C6917023698075E5BF7805DA7511F4CEB170480BD1FA03D7A1A109FF723352D8C1BED ike 0:Dallas_new:2186: sent IKE msg (ident_i3send): 67.78.211.86:500->66.133.218.42:500, len=108, id=cfc7c7c808af2905/a19c9eb0c30baaa7 ike 0: comes 66.133.218.42:500->67.78.211.86:500,ifindex=4.... ike 0: IKEv1 exchange=Identity Protection id=cfc7c7c808af2905/a19c9eb0c30baaa7 len=76 ike 0: in CFC7C7C808AF2905A19C9EB0C30BAAA705100201000000000000004C3B26EA0B13D011531D588557C139E515D82D60A4B451F3D12B97A9995EEDF82912ACABBFD2034DF4EC669A64F29AF705 ike 0:Dallas_new:2186: initiator: main mode get 3rd response... ike 0:Dallas_new:2186: dec CFC7C7C808AF2905A19C9EB0C30BAAA705100201000000000000004C0800000C0100000042C4D02A00000018CBE97A38DB3204D9D318DAA20343508189DC84CAD094697683AD1DB40CED3B0B ike 0:Dallas_new:2186: peer identifier IPV4_ADDR 66.133.218.42 ike 0:Dallas_new:2186: PSK authentication succeeded ike 0:Dallas_new:2186: authentication OK ike 0:Dallas_new:2186: established IKE SA cfc7c7c808af2905/a19c9eb0c30baaa7 ike 0:Dallas_new:2186: initiating mode-cfg pull from peer ike 0:Dallas_new:2186: mode-cfg request APPLICATION_VERSION ike 0:Dallas_new:2186: mode-cfg request INTERNAL_IP4_ADDRESS ike 0:Dallas_new:2186: mode-cfg request INTERNAL_IP4_NETMASK ike 0:Dallas_new:2186: mode-cfg request INTERNAL_IP4_SUBNET ike 0:Dallas_new:2186: enc CFC7C7C808AF2905A19C9EB0C30BAAA708100601C92715640000007B0E0000181370FC1993D5265E11AED82BFD4B1FDD0B87F4C200000047010070DC0007002F466F727469476174652D3630432076352E322E31332C6275696C6430373632623736322C31373132313220284741290001000000020000000D0000 ike 0:Dallas_new:2186: out CFC7C7C808AF2905A19C9EB0C30BAAA708100601C92715640000007C53DB4F130C20E74A86D5D1DA3806FA504F066CB972AADA229F186D770A50EEB31887D1AE7845799F56CA58D2FE2B1D9478EB89B67B4DCFA15FEBC8C1578759B617283C15A718BD82F6CEC70D0A6523A62769B41C3F5E13BA8EB77967956DB5C6 ike 0:Dallas_new:2186: sent IKE msg (cfg_send): 67.78.211.86:500->66.133.218.42:500, len=124, id=cfc7c7c808af2905/a19c9eb0c30baaa7:c9271564 ike 0: comes 66.133.218.42:500->67.78.211.86:500,ifindex=4.... ike 0: IKEv1 exchange=Mode config id=cfc7c7c808af2905/a19c9eb0c30baaa7:c9271564 len=108 ike 0: in CFC7C7C808AF2905A19C9EB0C30BAAA708100601C92715640000006C13F3AE8E542BA3C860BB185C08F0ABC4904E17DAA8C4778F06AFC27449B59E74F94D876A084F8B7B20DFBC99562F447102B1C1D353C096EADDB1732D84D830032ED37EDD131D0BC663DA96D4213802CD ike 0:Dallas_new:2186: dec CFC7C7C808AF2905A19C9EB0C30BAAA708100601C92715640000006C0E0000183F0E46F8DD461B81C6E449AD713255CDF7210A2000000037020070DC0007002B466F727469676174652D313030412076342E30302E372C6275696C6430333234623332342C31313035323000 ike 0:Dallas_new:2186: mode-cfg received APPLICATION_VERSION 'Fortigate-100A v4.00.7,build0324b324,110520' ike 0:Dallas_new:2186: mode-cfg missing INTERNAL_IP4_ADDRESS ike 0:Dallas_new:2186: send ISAKMP delete cfc7c7c808af2905/a19c9eb0c30baaa7 ike 0:Dallas_new:2186: enc CFC7C7C808AF2905A19C9EB0C30BAAA70810050160CFBE13000000500C0000184CA4E8AA183CDAE20EC2919C87094E2E26DFEEEE0000001C0000000101100001CFC7C7C808AF2905A19C9EB0C30BAAA7 ike 0:Dallas_new:2186: out CFC7C7C808AF2905A19C9EB0C30BAAA70810050160CFBE130000005C0456CAB5CB56EEE3CDBD20BC4DF915FAB30F37D421FB4AF17C710FAEBAF3A79A18524A5E9AA1AE817ED2C4395F938863B71884C196FA1A90D7B204908377B1F9 ike 0:Dallas_new:2186: sent IKE msg (ISAKMP SA DELETE-NOTIFY): 67.78.211.86:500->66.133.218.42:500, len=92, id=cfc7c7c808af2905/a19c9eb0c30baaa7:60cfbe13 ike 0:Dallas_new: connection expiring due to phase1 down ike 0:Dallas_new: deleting ike 0:Dallas_new: flushing ike 0:Dallas_new: flushed ike 0:Dallas_new: deleted ike 0:Dallas_new: schedule auto-negotiate s_new: auto-negotiate connection ike 0:Dallas_new: created connection: 0x24bdbc0 4 67.78.211.86->66.133.218.42:500. ike 0:Dallas_new:2187: initiator: main mode is sending 1st message... ike 0:Dallas_new:2187: cookie 5c1605dc684fbc28/0000000000000000 ike 0:Dallas_new:2187: out 5C1605DC684FBC2800000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00C08003000180020002800400050D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:Dallas_new:2187: sent IKE msg (ident_i1send): 67.78.211.86:500->66.133.218.42:500, len=288, id=5c1605dc684fbc28/0000000000000000 ike 0: comes 66.133.218.42:500->67.78.211.86:500,ifindex=4.... ike 0: IKEv1 exchange=Identity Protection id=5c1605dc684fbc28/db9be36c75edfeac len=124 ike 0: in 5C1605DC684FBC28DB9BE36C75EDFEAC01100200000000000000007C0D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00C08003000180020002800400050D0000144A131C81070358455C5728F20E95452F00000014AFCAD71368A1F1C96B8696FC77570100 ike 0:Dallas_new:2187: initiator: main mode get 1st response... ike 0:Dallas_new:2187: VID RFC 3947 4A131C81070358455C5728F20E95452F ike 0:Dallas_new:2187: VID DPD AFCAD71368A1F1C96B8696FC77570100 ike 0:Dallas_new:2187: DPD negotiated ike 0:Dallas_new:2187: selected NAT-T version: RFC 3947 ike 0:Dallas_new:2187: negotiation result ike 0:Dallas_new:2187: proposal id = 1: ike 0:Dallas_new:2187: protocol id = ISAKMP: ike 0:Dallas_new:2187: trans_id = KEY_IKE. ike 0:Dallas_new:2187: encapsulation = IKE/none ike 0:Dallas_new:2187: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:Dallas_new:2187: type=OAKLEY_HASH_ALG, val=SHA. ike 0:Dallas_new:2187: type=AUTH_METHOD, val=PRESHARED_KEY. ike 0:Dallas_new:2187: type=OAKLEY_GROUP, val=MODP1536. ike 0:Dallas_new:2187: ISAKMP SA lifetime=28800 ike 0:Dallas_new:2187: out 5C1605DC684FBC28DB9BE36C75EDFEAC0410020000000000000001240A0000C40E82F1A5FC19DC2448949458AFF5401FBC4775A74A694A723C930863E4A7EA7311FBE53CE5CA5CCA276434757A4413F7C1FA670FB6B327A1287C71679F305CDC2C24CD45E76A9FE066503E0DB91A1455DAAD294A6E10FF979B111A5A00CA702153A93952975519A9D53742DF8EFC4F4F0677105AFED84CDC004431FE7C8167D44E1533192F06053A3F6C3475CDEB0F5399912F117A49B0C0C9EF6CBB21E9CD4F086637B4299605B91BAD69D4A913503E1026F6D7F95D7D99765E322C8A820529140000144248684B8C189950000FD9D24358E29114000018B15D020C372FA9C1378296973C3E5A860067E524000000185CBC73C211CECD94C9AE81842D7E0AC93238D0A5 ike 0:Dallas_new:2187: sent IKE msg (ident_i2send): 67.78.211.86:500->66.133.218.42:500, len=292, id=5c1605dc684fbc28/db9be36c75edfeac ike 0: comes 66.133.218.42:500->67.78.211.86:500,ifindex=4.... ike 0: IKEv1 exchange=Identity Protection id=5c1605dc684fbc28/db9be36c75edfeac len=292 ike 0: in 5C1605DC684FBC28DB9BE36C75EDFEAC0410020000000000000001240A0000C4221E70F6C9E4C94B34D6E37047FA5CC0E64467FD45BCE5469045F3AD4DA33C08C68E5F44AD172FD99E683AEC2D44BB3B0C2BC7555C3624D6FA95FDC680589F092E7BFAFAE188E5AD72EF86BCB4FCB5D236A7DE13142CD6D77980D12A3A89BC54B700456DF7EEF56528BA70C8FDC7D6FE22DA2197B00D3EDF555E961C591860A0ABA10827E082BB65E8A9CBC11303CE496D2648CAD9874E00AF9F613897C03A299A6E9206E17981DF7BA19D933EC4217B4B264F4416874FC51DDB822A8BDCFED5140000147CEA7F591BBBE222504FDF6F69408CF4140000185CBC73C211CECD94C9AE81842D7E0AC93238D0A500000018B15D020C372FA9C1378296973C3E5A860067E524 ike 0:Dallas_new:2187: initiator: main mode get 2nd response... ike 0:Dallas_new:2187: NAT not detected ike 0:Dallas_new:2187: ISAKMP SA 5c1605dc684fbc28/db9be36c75edfeac key 24:96FB7E8EEE8C3A47E37BA07F7887DB409E5311B1E0A0F193 ike 0:Dallas_new:2187: add INITIAL-CONTACT ike 0:Dallas_new:2187: enc 5C1605DC684FBC28DB9BE36C75EDFEAC05100201000000000000005C0800000C01000000434FDD560B000018B7BB3068E290DD0BC4841CCA976BC62F19DE846C0000001C00000001011060025C1605DC684FBC28DB9BE36C75EDFEAC ike 0:Dallas_new:2187: out 5C1605DC684FBC28DB9BE36C75EDFEAC05100201000000000000006C39F5770C08629AD8141DF0E36E3E627639B47C665E8F3E08033D40B1668A8BB3D03D77D4E33DBC5E2110E9E175A24D6510A05294F8BACC1E47E3F88212F060E00B47B510FC2E74871A23A8C8ECC826B4 ike 0:Dallas_new:2187: sent IKE msg (ident_i3send): 67.78.211.86:500->66.133.218.42:500, len=108, id=5c1605dc684fbc28/db9be36c75edfeac ike 0: comes 66.133.218.42:500->67.78.211.86:500,ifindex=4.... ike 0: IKEv1 exchange=Identity Protection id=5c1605dc684fbc28/db9be36c75edfeac len=76 ike 0: in 5C1605DC684FBC28DB9BE36C75EDFEAC05100201000000000000004CEF3062F2A06A2DC5D0C0BE5AB676C05C35B4B0AB983DFD76B42412E7CAD5B46A7FF5440778E8F95BD972D8B66F492F02 ike 0:Dallas_new:2187: initiator: main mode get 3rd response... ike 0:Dallas_new:2187: dec 5C1605DC684FBC28DB9BE36C75EDFEAC05100201000000000000004C0800000C0100000042C4D02A000000185CEE956A9C30C5E3D197CAE8EA4FF30B43AA16AB14E6FAC039BAA10BA4DE850B ike 0:Dallas_new:2187: peer identifier IPV4_ADDR 66.133.218.42 ike 0:Dallas_new:2187: PSK authentication succeeded ike 0:Dallas_new:2187: authentication OK ike 0:Dallas_new:2187: established IKE SA 5c1605dc684fbc28/db9be36c75edfeac ike 0:Dallas_new:2187: initiating mode-cfg pull from peer ike 0:Dallas_new:2187: mode-cfg request APPLICATION_VERSION ike 0:Dallas_new:2187: mode-cfg request INTERNAL_IP4_ADDRESS ike 0:Dallas_new:2187: mode-cfg request INTERNAL_IP4_NETMASK ike 0:Dallas_new:2187: mode-cfg request INTERNAL_IP4_SUBNET ike 0:Dallas_new:2187: enc 5C1605DC684FBC28DB9BE36C75EDFEAC08100601A3868FB60000007B0E000018DA904352171B6DFD5D4439C94E29ADD8DDD8A696000000470100A2940007002F466F727469476174652D3630432076352E322E31332C6275696C6430373632623736322C31373132313220284741290001000000020000000D0000 ike 0:Dallas_new:2187: out 5C1605DC684FBC28DB9BE36C75EDFEAC08100601A3868FB60000007C3F40885007F993F0F3FF12409B6D0427C6661C1B3D794773352970223C605C01C5BF369C78220B072F60FE52F85C060C64F4853DA52CC4E01CFD9993DD2D6986ACFF3B89A9202F84A37A2CFB3F59457E64DD64E96663AF52DEB0490692D7ACC9 ike 0:Dallas_new:2187: sent IKE msg (cfg_send): 67.78.211.86:500->66.133.218.42:500, len=124, id=5c1605dc684fbc28/db9be36c75edfeac:a3868fb6 ike 0: comes 66.133.218.42:500->67.78.211.86:500,ifindex=4.... ike 0: IKEv1 exchange=Mode config id=5c1605dc684fbc28/db9be36c75edfeac:a3868fb6 len=108 ike 0: in 5C1605DC684FBC28DB9BE36C75EDFEAC08100601A3868FB60000006CFBCCA12EC81C5AF10CB12F3F33D1DF0157F30DEE5E89799F024EF26A47C7111F1E522BEA44D3680A07EFC8F79B16C3EC3F87907FC1432AA5F1385312E70FE7CE0B2B67895DEC0EFA6F29CC61C2B970B2 ike 0:Dallas_new:2187: dec 5C1605DC684FBC28DB9BE36C75EDFEAC08100601A3868FB60000006C0E0000184B7949B24ED04676590FD8C69729FB5B608F4388000000370200A2940007002B466F727469676174652D313030412076342E30302E372C6275696C6430333234623332342C31313035323000 ike 0:Dallas_new:2187: mode-cfg received APPLICATION_VERSION 'Fortigate-100A v4.00.7,build0324b324,110520' ike 0:Dallas_new:2187: mode-cfg missing INTERNAL_IP4_ADDRESS ike 0:Dallas_new:2187: send ISAKMP delete 5c1605dc684fbc28/db9be36c75edfeac ike 0:Dallas_new:2187: enc 5C1605DC684FBC28DB9BE36C75EDFEAC08100501E19D3A10000000500C000018205F693C256131C2F3DDB16824FE11C0A69138530000001C00000001011000015C1605DC684FBC28DB9BE36C75EDFEAC ike 0:Dallas_new:2187: out 5C1605DC684FBC28DB9BE36C75EDFEAC08100501E19D3A100000005C2ABB91585CA598900DFF1430FE75360618AB067D2EA1277A56E9C1D30B7819F6C5730C68FD2CEE9ACAFCD4DE372C79FABECB7DB21D7D12F82A3D1650D34EDA1B ike 0:Dallas_new:2187: sent IKE msg (ISAKMP SA DELETE-NOTIFY): 67.78.211.86:500->66.133.218.42:500, len=92, id=5c1605dc684fbc28/db9be36c75edfeac:e19d3a10 ike 0:Dallas_new: connection expiring due to phase1 down ike 0:Dallas_new: deleting ike 0:Dallas_new: flushing ike 0:Dallas_new: flushed ike 0:Dallas_new: deleted ike 0:Dallas_new: schedule auto-negotiate tion ike -1ike 0:Dallas_new: auto-negotiate connection ike 0:Dallas_new: created connection: 0x24bdbc0 4 67.78.211.86->66.133.218.42:500. ike 0:Dallas_new:2188: initiator: main mode is sending 1st message... ike 0:Dallas_new:2188: cookie 27b6f4486bb7b378/0000000000000000 ike 0:Dallas_new:2188: out 27B6F4486BB7B37800000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00C08003000180020002800400050D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:Dallas_new:2188: sent IKE msg (ident_i1send): 67.78.211.86:500->66.133.218.42:500, len=288, id=27b6f4486bb7b378/0000000000000000 ike 0: comes 66.133.218.42:500->67.78.211.86:500,ifindex=4.... ike 0: IKEv1 exchange=Identity Protection id=27b6f4486bb7b378/8cff136af896c192 len=124 ike 0: in 27B6F4486BB7B3788CFF136AF896C19201100200000000000000007C0D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00C08003000180020002800400050D0000144A131C81070358455C5728F20E95452F00000014AFCAD71368A1F1C96B8696FC77570100 ike 0:Dallas_new:2188: initiator: main mode get 1st response... ike 0:Dallas_new:2188: VID RFC 3947 4A131C81070358455C5728F20E95452F ike 0:Dallas_new:2188: VID DPD AFCAD71368A1F1C96B8696FC77570100 ike 0:Dallas_new:2188: DPD negotiated ike 0:Dallas_new:2188: selected NAT-T version: RFC 3947 ike 0:Dallas_new:2188: negotiation result ike 0:Dallas_new:2188: proposal id = 1: ike 0:Dallas_new:2188: protocol id = ISAKMP: ike 0:Dallas_new:2188: trans_id = KEY_IKE. ike 0:Dallas_new:2188: encapsulation = IKE/none ike 0:Dallas_new:2188: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:Dallas_new:2188: type=OAKLEY_HASH_ALG, val=SHA. ike 0:Dallas_new:2188: type=AUTH_METHOD, val=PRESHARED_KEY. ike 0:Dallas_new:2188: type=OAKLEY_GROUP, val=MODP1536. ike 0:Dallas_new:2188: ISAKMP SA lifetime=28800 ike 0:Dallas_new:2188: out 27B6F4486BB7B3788CFF136AF896C1920410020000000000000001240A0000C46324E73CEA97BAD30363B97ED0C7AD59F9381CA75C3493980046B05A4B1F613E44D5291C96BDA28078D3085E718858181DFC50A1EC15B06AD7739599225298AE49078C071259591E33C0B7384DF62670DE176E6CC6DEAF982F7114BFDCDE2FCABC2756AFD38EA9BC0CFB142E3F6111636C3E37D7984781A30F85C16C7EA400E8CF16F14A8430E54E87EE681DFEB50EDBCE378F4AD0ABB8EA6CCA9C9481BB52024D30E5399A727C7E1F090AEC7A9BE95E0DAB047A6BB3AEBE8467C2CF22A46F90140000145162BCFED0D7700BF0788E25BCA5CF0E14000018C64976A4F9D938315AC6C8C504E765CA87D746150000001831EAC5C21C7FA36FD938DDF4691DE6E4D646E43E ike 0:Dallas_new:2188: sent IKE msg (ident_i2send): 67.78.211.86:500->66.133.218.42:500, len=292, id=27b6f4486bb7b378/8cff136af896c192 ike 0: comes 66.133.218.42:500->67.78.211.86:500,ifindex=4.... ike 0: IKEv1 exchange=Identity Protection id=27b6f4486bb7b378/8cff136af896c192 len=292 ike 0: in 27B6F4486BB7B3788CFF136AF896C1920410020000000000000001240A0000C4CF79564327261DF880B96C5B0930F34FD9572876AF908D41283B36C5EA27F5D41ADF357A54976E50E715B684F7A6D333F0FBD8DE8E753B8467A40CD09A1741E44454E83C34FD7044B94D62CC32E46F818290386DFA06C66327A4C4A0B916DC28EEFB0CFE06947B34176902D681BCDF8F1676E8B03C47FD01F0B13F9DCA6CE114920C535F801ACF1278FDDB8A1B72213C511516C721F681A0A27DDC9E2A34E86E97AE28C97C6B4A14F0326B052F0B9DA907BE6EB61AFB998C7C9C797C7987C5271400001455894FFA1125BBC42127916B827BB5541400001831EAC5C21C7FA36FD938DDF4691DE6E4D646E43E00000018C64976A4F9D938315AC6C8C504E765CA87D74615 ike 0:Dallas_new:2188: initiator: main mode get 2nd response... ike 0:Dallas_new:2188: NAT not detected ike 0:Dallas_new:2188: ISAKMP SA 27b6f4486bb7b378/8cff136af896c192 key 24:0BAD11B38D5B6AE5E9D48A85F6411F92F19902551AFD4763 ike 0:Dallas_new:2188: add INITIAL-CONTACT ike 0:Dallas_new:2188: enc 27B6F4486BB7B3788CFF136AF896C19205100201000000000000005C0800000C01000000434FDD560B000018829BBE7F149C4634DF3CF3D30CFD778D0943111F0000001C000000010110600227B6F4486BB7B3788CFF136AF896C192 ike 0:Dallas_new:2188: out 27B6F4486BB7B3788CFF136AF896C19205100201000000000000006C572965E26581418B3B0A21FFD533DBB16CF106DF35A4CF4D6681D23594D11F10B4081A50A0075495AA47B04B91B7C5622EE1BA9BAACC1B401A869AFCFB7F15752C4395525F6DA2EBD69D5C2C89D83AC5 ike 0:Dallas_new:2188: sent IKE msg (ident_i3send): 67.78.211.86:500->66.133.218.42:500, len=108, id=27b6f4486bb7b378/8cff136af896c192 ike 0: comes 66.133.218.42:500->67.78.211.86:500,ifindex=4.... ike 0: IKEv1 exchange=Identity Protection id=27b6f4486bb7b378/8cff136af896c192 len=76 ike 0: in 27B6F4486BB7B3788CFF136AF896C19205100201000000000000004C23B5BD713B317859EF5893A4E80AA02F989D90FED64AB9F5D5765FB5868D8303C17779BD013977742E922EF713AA977E ike 0:Dallas_new:2188: initiator: main mode get 3rd response... ike 0:Dallas_new:2188: dec 27B6F4486BB7B3788CFF136AF896C19205100201000000000000004C0800000C0100000042C4D02A0000001860A1DC2303A8DD0FC79C446DD7D5B639C76E4AD870ED72F2016BB9A594E1CF0B ike 0:Dallas_new:2188: peer identifier IPV4_ADDR 66.133.218.42 ike 0:Dallas_new:2188: PSK authentication succeeded ike 0:Dallas_new:2188: authentication OK ike 0:Dallas_new:2188: established IKE SA 27b6f4486bb7b378/8cff136af896c192 ike 0:Dallas_new:2188: initiating mode-cfg pull from peer ike 0:Dallas_new:2188: mode-cfg request APPLICATION_VERSION ike 0:Dallas_new:2188: mode-cfg request INTERNAL_IP4_ADDRESS ike 0:Dallas_new:2188: mode-cfg request INTERNAL_IP4_NETMASK ike 0:Dallas_new:2188: mode-cfg request INTERNAL_IP4_SUBNET ike 0:Dallas_new:2188: enc 27B6F4486BB7B3788CFF136AF896C19208100601F0BA3FF00000007B0E000018B8904BEB6E86C2D3FF69E97C0368A8722FB586770000004701006C710007002F466F727469476174652D3630432076352E322E31332C6275696C6430373632623736322C31373132313220284741290001000000020000000D0000 ike 0:Dallas_new:2188: out 27B6F4486BB7B3788CFF136AF896C19208100601F0BA3FF00000007C7AF29F73FB2A838A57A8E91FC883CEDB7C545DA18204E7DA15474D1BBE5C0B0E9C531EFD75CFA628741862060D104279EAA2DCD5377529643755F7D87B4823CEA23F60BD393BC2C8C8F983B52EDA8485899AE5138B795A329A52D1BB26ED871E ike 0:Dallas_new:2188: sent IKE msg (cfg_send): 67.78.211.86:500->66.133.218.42:500, len=124, id=27b6f4486bb7b378/8cff136af896c192:f0ba3ff0 ike 0: comes 66.133.218.42:500->67.78.211.86:500,ifindex=4.... ike 0: IKEv1 exchange=Mode config id=27b6f4486bb7b378/8cff136af896c192:f0ba3ff0 len=108 ike 0: in 27B6F4486BB7B3788CFF136AF896C19208100601F0BA3FF00000006CB51DEEAD14BE1D747999EDD8D39FDAD563923BAF28AEE10657916F8B111075B478BAB2FDCBF9017530E6E39565B0CCF4772C053DCF8736DB4BA85120DA3DCBADFD74C58B15AD0E8EE3B65A57EFA606F6 ike 0:Dallas_new:2188: dec 27B6F4486BB7B3788CFF136AF896C19208100601F0BA3FF00000006C0E000018AD671918CB3DDF52CB75C86C5077ACA644402EF20000003702006C710007002B466F727469676174652D313030412076342E30302E372C6275696C6430333234623332342C31313035323000 ike 0:Dallas_new:2188: mode-cfg received APPLICATION_VERSION 'Fortigate-100A v4.00.7,build0324b324,110520' ike 0:Dallas_new:2188: mode-cfg missing INTERNAL_IP4_ADDRESS ike 0:Dallas_new:2188: send ISAKMP delete 27b6f4486bb7b378/8cff136af896c192 ike 0:Dallas_new:2188: enc 27B6F4486BB7B3788CFF136AF896C19208100501298F183B000000500C000018C34E0C213D3208A459943664C644B2136A162C470000001C000000010110000127B6F4486BB7B3788CFF136AF896C192 ike 0:Dallas_new:2188: out 27B6F4486BB7B3788CFF136AF896C19208100501298F183B0000005C396BB4A1FBE50455E20FDB9B7DBDE36CC14C78653FCBD6DAFE2131D27662F86DCA7D8A615679C6FAD2FACE867EB8AEC6A7890087C3B7F7FA6543F0FCC50A65D4 ike 0:Dallas_new:2188: sent IKE msg (ISAKMP SA DELETE-NOTIFY): 67.78.211.86:500->66.133.218.42:500, len=92, id=27b6f4486bb7b378/8cff136af896c192:298f183b ike 0:Dallas_new: connection expiring due to phase1 down ike 0:Dallas_new: deleting ike 0:Dallas_new: flushing ike 0:Dallas_new: flushed ike 0:Dallas_new: deleted ike 0:Dallas_new: schedule auto-negotiate

[ede_pfau]

Why mode-cfg?? Set up a regular VPN, that should w is cork. Mode-cfg is a method to automate parameter exchange for mobile clients.

from the logs:

The PSK is OK on both sides.

AES-128 plus SHA128 is a good choice (but it's not used here)

And be sure that on both FGTs there is a valid policy for the VPN - the VPN will not establish without.

In your next post, show us the configuration parameters, not only the error logs - although it's more challenging.