Cisco VPN with fortinet 200B

[MISLuke]

Hi, I am trying to setup a cisco vpn client version 5 to communciate with my fortinet 200B. But i get this error " negotiation failure ike Negotiate SA Error: ike ike [1074] ike 0:ciscovpn:15: no SA proposal chosen no SA proposal chosen" my phase 1 setup is 3DES-SHA1, group 5, xauth " enable as server" my phase 2 setup is 3DES-SHA1, group 2, enable replay, enable pfs. dialup clients are using 192.168.254.1-100 with subnet mask 255.255.255.0 internal lan is 192.168.10x.x with subnet mask 255.255.252.0 public ip of firewall is 202.x.x.x and able to ping and access https from internet to the public ip of firewall

[emnoc]

Good luck with that, let us know if you can get it working, but what I can tell, cisco vpnclient is proprietary to cisco devices. Shrew Net on the other hand works with no problems. Also are you 100% sure pfs should be enable for re-negoitation of ph2 SA? If this would help, here' s how a ASA dynamic-client config looks on my ASA. crypto dynamic-map remoteaccess 10 set transform-set ESP-AES-192-SHA ESP-AES-128-MD5 ESP-AES-128-SHA ESP-3DES-SHA ESP-3DES-MD5 crypto dynamic-map remoteaccess 20 set transform-set ESP-AES-256-SHA crypto dynamic-map remoteaccess 21 set transform-set l2tp-windows-aes128 l2tp-windows-aes192 crypto dynamic-map remoteaccess 22 set transform-set l2tp-windows-aes192 crypto dynamic-map remoteaccess 23 set transform-set l2tp-windows-aes256 crypto map outside_map0 10 set trustpoint fwf50f crypto map outside_map0 65535 ipsec-isakmp dynamic remoteaccess crypto map outside_map0 interface outside If you have any detailed logs from the ciscovpnclient client connection, post them as well.

[ede_pfau]

Try phase1 without XAuth first, just PSK. If that works, proceed. You haven' t specified ph2 PFS setting. I would be careful with the ASA example as it allows AES-256. This seems to be broken in one of the latest FortiOS versions (search the forum for it please). Do you know that the FortiClient IPSec VPN thingy is available for free? Might be a simpler alternative. That is, if you don' t already have 5.000 installs out there...

[MISLuke]

The reason to use cisco vpn is to have a common client platform for both windows & Mac machines. In any case, I was following what was written in the fortinet technical note on the setup. Below is the diag debug log in had on my 200B. I am using 4.0 MR1 patch 4 build 5029. the client machine IP is 27.54.21.170. ike 0:ciscovpn: new connection. ike 0:ciscovpn: check for IP assignment method ... ike 0:ciscovpn: no IP assignment method defined ike 0:ciscovpn:15: responder: aggressive mode get 1st message... ike 0:ciscovpn:15: VID draft-ietf-ipsra-isakmp-xauth-06.txt 09002689DFD6B712 ike 0:ciscovpn:15: XAUTHv6 negotiated ike 0:ciscovpn:15: VID DPD AFCAD71368A1F1C96B8696FC77570100 ike 0:ciscovpn:15: DPD negotiated ike 0:ciscovpn:15: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D380000000 ike 0:ciscovpn:15: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F ike 0:ciscovpn:15: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100 ike 0:ciscovpn:15: UNITY support enabled ike 0:ciscovpn:15: incoming proposal: ike 0:ciscovpn:15: proposal id = 0: ike 0:ciscovpn:15: protocol id = ISAKMP: ike 0:ciscovpn:15: trans_id = KEY_IKE. ike 0:ciscovpn:15: encapsulation = IKE/none ike 0:ciscovpn:15: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:ciscovpn:15: type=OAKLEY_HASH_ALG, val=SHA. ike 0:ciscovpn:15: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:ciscovpn:15: type=OAKLEY_GROUP, val=1024. ike 0:ciscovpn:15: ISKAMP SA lifetime=2147483 ike 0:ciscovpn:15: proposal id = 0: ike 0:ciscovpn:15: protocol id = ISAKMP: ike 0:ciscovpn:15: trans_id = KEY_IKE. ike 0:ciscovpn:15: encapsulation = IKE/none ike 0:ciscovpn:15: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:ciscovpn:15: type=OAKLEY_HASH_ALG, val=MD5. ike 0:ciscovpn:15: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:ciscovpn:15: type=OAKLEY_GROUP, val=1024. ike 0:ciscovpn:15: ISKAMP SA lifetime=2147483 ike 0:ciscovpn:15: proposal id = 0: ike 0:ciscovpn:15: protocol id = ISAKMP: ike 0:ciscovpn:15: trans_id = KEY_IKE. ike 0:ciscovpn:15: encapsulation = IKE/none ike 0:ciscovpn:15: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:ciscovpn:15: type=OAKLEY_HASH_ALG, val=SHA. ike 0:ciscovpn:15: type=AUTH_METHOD, val=PRESHARED_KEY. ike 0:ciscovpn:15: type=OAKLEY_GROUP, val=1024. ike 0:ciscovpn:15: ISKAMP SA lifetime=2147483 ike 0:ciscovpn:15: proposal id = 0: ike 0:ciscovpn:15: protocol id = ISAKMP: ike 0:ciscovpn:15: trans_id = KEY_IKE. ike 0:ciscovpn:15: encapsulation = IKE/none ike 0:ciscovpn:15: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:ciscovpn:15: type=OAKLEY_HASH_ALG, val=MD5. ike 0:ciscovpn:15: type=AUTH_METHOD, val=PRESHARED_KEY. ike 0:ciscovpn:15: type=OAKLEY_GROUP, val=1024. ike 0:ciscovpn:15: ISKAMP SA lifetime=2147483 ike 0:ciscovpn:15: proposal id = 0: ike 0:ciscovpn:15: protocol id = ISAKMP: ike 0:ciscovpn:15: trans_id = KEY_IKE. ike 0:ciscovpn:15: encapsulation = IKE/none ike 0:ciscovpn:15: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:ciscovpn:15: type=OAKLEY_HASH_ALG, val=SHA. ike 0:ciscovpn:15: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:ciscovpn:15: type=OAKLEY_GROUP, val=1024. ike 0:ciscovpn:15: ISKAMP SA lifetime=2147483 ike 0:ciscovpn:15: proposal id = 0: ike 0:ciscovpn:15: protocol id = ISAKMP: ike 0:ciscovpn:15: trans_id = KEY_IKE. ike 0:ciscovpn:15: encapsulation = IKE/none ike 0:ciscovpn:15: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:ciscovpn:15: type=OAKLEY_HASH_ALG, val=MD5. ike 0:ciscovpn:15: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:ciscovpn:15: type=OAKLEY_GROUP, val=1024. ike 0:ciscovpn:15: ISKAMP SA lifetime=2147483 ike 0:ciscovpn:15: proposal id = 0: ike 0:ciscovpn:15: protocol id = ISAKMP: ike 0:ciscovpn:15: trans_id = KEY_IKE. ike 0:ciscovpn:15: encapsulation = IKE/none ike 0:ciscovpn:15: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:ciscovpn:15: type=OAKLEY_HASH_ALG, val=SHA. ike 0:ciscovpn:15: type=AUTH_METHOD, val=PRESHARED_KEY. ike 0:ciscovpn:15: type=OAKLEY_GROUP, val=1024. ike 0:ciscike 0:ciscovpn:15: ISKAMP SA lifetime=2147483 ike 0:ciscovpn:15: my proposal: ike 0:ciscovpn:15: proposal id = 1: ike 0:ciscovpn:15: protocol id = ISAKMP: ike 0:ciscovpn:15: trans_id = KEY_IKE. ike 0:ciscovpn:15: encapsulation = IKE/none ike 0:ciscovpn:15: type=OAKLEY_ENCRYPT_ALG, val=3DES_CBC. ike 0:ciscovpn:15: type=OAKLEY_HASH_ALG, val=SHA. ike 0:ciscovpn:15: type=AUTH_METHOD, val=PRESHARED_KEY. ike 0:ciscovpn:15: type=OAKLEY_GROUP, val=1536. ike 0:ciscovpn:15: ISKAMP SA lifetime=28800 ike 0:ciscovpn:15: proposal id = 1: ike 0:ciscovpn:15: protocol id = ISAKMP: ike 0:ciscovpn:15: trans_id = KEY_IKE. ike 0:ciscovpn:15: encapsulation = IKE/none ike 0:ciscovpn:15: type=OAKLEY_ENCRYPT_ALG, val=3DES_CBC. ike 0:ciscovpn:15: type=OAKLEY_HASH_ALG, val=SHA. ike 0:ciscovpn:15: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:ciscovpn:15: type=OAKLEY_GROUP, val=1536. ike 0:ciscovpn:15: ISKAMP SA lifetime=28800 ike 0:ciscovpn:15: negotiation failure ike Negotiate SA Error: ike ike [1074] ike 0:ciscovpn:15: no SA proposal chosen ike 0:ciscovpn: responder error processing 1st msg from 27.54.21.170 ike 0:ciscovpn: connection expiring due to phase1 down ike 0:ciscovpn: deleting ike 0:ciscovpn: flushing ike 0:ciscovpn: sending SNMP tunnel DOWN trap ike 0:ciscovpn: flushed ike 0:ciscovpn: deleted

[ede_pfau]

Hi, IMHO the PFS settings don' t match. The client offers 1024 bits (dhgroup=2), the FG offers 1536 bits (dhgroup=5). So they cannot agree.

[MISLuke]

I set both dhgroup to 2 and below is the log entries: the client ip address is 113.10.105.239 ke 0: comes 113.10.105.239:2524->202.x.x.x:500,ifindex=13.... ike 0: IKEv1 exchange=Aggressive id=fc258a8dd5cdae4d/0000000000000000 len=853 ike 0:ciscovpn: new connection. ike 0:ciscovpn: check for IP assignment method ... ike 0:ciscovpn: no IP assignment method defined ike 0:ciscovpn:42: responder: aggressive mode get 1st message... ike 0:ciscovpn:42: VID draft-ietf-ipsra-isakmp-xauth-06.txt 09002689DFD6B712 ike 0:ciscovpn:42: XAUTHv6 negotiated ike 0:ciscovpn:42: VID DPD AFCAD71368A1F1C96B8696FC77570100 ike 0:ciscovpn:42: DPD negotiated ike 0:ciscovpn:42: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D380000000 ike 0:ciscovpn:42: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F ike 0:ciscovpn:42: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100 ike 0:ciscovpn:42: UNITY support enabled ike 0:ciscovpn:42: negotiation result ike 0:ciscovpn:42: proposal id = 1: ike 0:ciscovpn:42: protocol id = ISAKMP: ike 0:ciscovpn:42: trans_id = KEY_IKE. ike 0:ciscovpn:42: encapsulation = IKE/none ike 0:ciscovpn:42: type=OAKLEY_ENCRYPT_ALG, val=3DES_CBC. ike 0:ciscovpn:42: type=OAKLEY_HASH_ALG, val=SHA. ike 0:ciscovpn:42: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:ciscovpn:42: type=OAKLEY_GROUP, val=1024. ike 0:ciscovpn:42: ISKAMP SA lifetime=28800 ike 0:ciscovpn:42: selected NAT-T version: draft-ietf-ipsec-nat-t-ike-02\n ike 0:ciscovpn:42: put connection to natt list...ip=113.10.105.239. ike 0:ciscovpn:42: cookie fc258a8dd5cdae4d/48fa5870ba461729 ike 0:ciscovpn:42: sent IKE msg (agg_r1send): 202.x.x.x:500->113.10.105.239:2524, len=392 ike 0:ciscovpn:42: sent IKE msg (P1_RETRANSMIT): 202.x.x.x:500->113.10.105.239:2524, len=392 ike 0: comes 113.10.105.239:2524->202.x.x.x:500,ifindex=13.... ike 0: IKEv1 exchange=Informational id=fc258a8dd5cdae4d/48fa5870ba461729 len=56 ike 0:ciscovpn: Incoming 113.10.105.239, my:113.10.105.239. ike 0:ciscovpn: got conn from natt list, 202.x.x.x->113.10.105.239:2524. ike 0:ciscovpn:42: ignoring unsupported INFORMATIONAL message 0. ike 0: comes 113.10.105.239:2524->202.x.x.x:500,ifindex=13.... ike 0: IKEv1 exchange=Informational id=fc258a8dd5cdae4d/48fa5870ba461729 len=56 ike 0: found ciscovpn 202.x.x.x 13 -> 113.10.105.239:2524 ike 0:ciscovpn:42: ignoring unsupported INFORMATIONAL message 0. ike 0:ciscovpn:42: sent IKE msg (P1_RETRANSMIT): 202.x.x.x:500->113.10.105.239:2524, len=392 ike 0:ciscovpn:42: sent IKE msg (P1_RETRANSMIT): 202.x.x.x:500->113.10.105.239:2524, len=392

[Carl_Wallmark]

Here is a KB about setting up the FortiGate for Cisco VPN client: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30166&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=10769391&stateId=0 0 10767886

[emnoc]

So if cisco vpnclient works with the fortigate, how about the other way around? Does forticlient works with cisco ASA or IOS routers? just curious

[Carl_Wallmark]

well yes, i have not tried it, but you need to install FortiClient with a switch, then forticlient will support Cisco Unity: Check this:' http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD32514&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=10887644&stateId=0 0 10889654

[ede_pfau]

very nice! is says: " msiexec /i FortiClient.msi IKEVENDORID=CISCO-UNITY" i.e. you need the .msi format download, not the .exe as usual.