Changed ISPs, can't get VPN to come back up

[HughOD]

On a FortiWiFi 90D, we changed our ISP and now we can't get out IPSec VPN with our phone vendor back up.  Nothing else has changed.

We changed:

[ol]

System...Network...Interfaces... wan2[ul]

IP/Network Mask from old IP to 67.x.x.158/255.255.255.252[/ul]

Router...Static...Static Routes on Device wan2[ul]

Gateway from old IP to 67.x.x.157[/ul]

VPN...IPSec...Tunnels.."Our Tunnel"[ul]

Phase 1 Proposal... Local ID to our new WAN IP address[/ul][/ol]

I can't think of anything else that would need to change, however, we keep getting the following error in the Event Log:

     Log Description:  IPsec phase 1 error

     Message:  IPsec phase 1

     Outgoing Interface:  wan2      Peer Notification:  INVALID-ID-INFORMATION

     Reason:  peer notification      Status:  negotiate_error

I've taken over this router (used to SonicWalls), so if you need more info for anything from CLI, please let me know.

Any ideas????

Thanks!

[EMES]

Try and put the old LocalID back in. The other side is expecting that ID and wont take the new one unless the other side is reconfigured. Was anything at the phone vendor reconfigured, Usually with an ISP change you need to reconfigure all remote sides of a tunnel unless its only using the localID for verificaiton.

[rwpatterson]

Did you also change the peer IP on the remote unit? It needs to know where the other end has moved to.

[HughOD]

I'm sorry.  I neglected to mention that the phone vendor updated their side to match our new IP settings as well.

They have an Adtran and have the Peer Address matching our WAN IP and their RemoteID set as "IP Address" and matching our WAN IP address as well.

I'm just at a loss on what else to try.  I will say, no matter what I put in the Phase 1 - Local ID field... I get the same error.

Attached is their side of the VPN.

[rwpatterson]

Have you tried downing both sides of the tunnel and bringing them back up? I would need to see more of the P1 and P2 settings to add any more here.