I have encountered a issue, i´ve setup a vpn site-to-site connection between a fortigate and a sonicwall, but i´m having trouble getting the service to work.
here is the scenario:
FortiGate Device Setting
Go to VPN > IPSec > Phase 1.
Gateway Name: ToSonicWall
Remote Gateway: SonicWall Static Public IP Address: 10.2.2.2
Local Interface: 192.168.1.254
Mode: IkeV2
Authentication Method: Preshared Key
Preshared Key: preshared key
Advanced:
Encryption: AES256
Authentication: SHA512
DH Group: 2
Keylife: 28800
Dead Peer Detection: Disabled
the other settings as default.
the Phase 2 settings
Remote Gateway: 10.2.2.2
Select Advanced:
Encryption: AES256
Authentication: SHA512
Enable replay detection : Unchecked
DH group: 5
Keylife: 28800
Autokey Keep Alive : Checked
Quick Mode Selector
Source address: 192.168.0.0
Destination address: 192.168.1.0
To add the addresses
Go to Firewall > Address.
Select Create New to create the FortiGate address.
Enter a name for the address, for example FortiGate_network.
Enter the FortiGate IP address and subnet. “ Internal LAN Subnet ” 192.168.0.0/24
Select Create New again to create the SonicWALL address.
Enter the name for the address, for example SonicWALL_network.
Enter the SonicWall IP address and subnet. “ Remote LAN Subnet ” 192.168.1.0/24
To create a firewall policy for the VPN traffic going from the SonicWALL device to the FortiGate unit
Go to Firewall > Policy.
Source Interface: Internal
Source IP address: 192.168.0.0
Destination Interface: WAN1 (or external)
Destination Address Name: 10.2.2.2
Schedule: always
Service: ANY
Action: Encrypt
VPN Tunnel: ToSonicWall
Select Allow inbound
Select Allow outbound
My Internet Service Provider (ISP) on side 1 has provided me with a public IP address, 10.1.1.1/32. I need to manage this address in my FortiGate. Additionally, the ISP has assigned me an IP in the DMZ, 192.168.10.254, which I've placed on my WAN interface in my FortiGate. All the necessary settings have been configured for this interface. On the SonicWall, I've created the VPN connection to the public address, 10.1.1.1/32, as my destination.
When I check the FortiGate, the IPsec section shows traffic both on the outside and inside, but when I review the SonicWall, the site-to-site VPN doesn't establish a connection. In the SonicWall logs, I see the following message:
MESSAGE SOURCE DESTINATION IP PROTOCOL
953 VPN Payload Processing Error Warning IKEv2 Payload processing error 10.1.1.1, 500 10.2.2.2, 500 udp
974 VPN Initiator: Received IKE_AUTH Response Inform IKEv2 Initiator: Received IKE_AUTH response 10.1.1.1, 500 10.2.2.2, 500 udp
959 VPN Unable to Find IKE SA Warning IKEv2 Unable to find IKE SA 10.1.1.1, 500 10.2.2.2, 500 udp
940 VPN Initiator: Send IKE_AUTH Request Inform IKEv2 Initiator: Send IKE_AUTH Request 10.2.2.2, 500 10.1.1.1, 500 udp
943 VPN Accept IKE SA Proposal Inform IKEv2 Accept IKE SA Proposal 10.1.1.1, 500 10.2.2.2, 500 udp
973 VPN Initiator: Received IKE_SA_INT Response Inform IKEv2 Initiator: Received IKE_SA_INT response 10.1.1.1, 500 10.2.2.2, 500 udp
938 VPN Initiator: Send IKE_SA_INIT Request Inform IKEv2 Initiator: Send IKE_SA_INIT Request 10.2.2.2, 500 10.1.1.1, 500 udp
1052 VPN VPN Policy Modified Inform VPN policy CENTRAL is modified.
i appreciate a helping hand.
