FortiGate s2s vpn cannot select aes256 now missing from original config

[dbeitler]

As of yesterday, in the phase2 settings for a site-site VPN connection to Azure I had the following:

set proposal aes128-sha256 aes256-sha256

Last night, the connection failed.

Looking at the saved config from a couple of hours before I see the "set " as it was.

Now, however, I am unable to modify the phase2 settings to anything other than aes128, either through the command line or the GUI.  The drop down in the GUI will let me select AES256, and appears to save it, but if I go back, the setting reverts to AES128

In the CLI, I get a parse error for aes256.

Running V7.0.12 build8800

The FG seems to think the Phase1 connection is OK.  Azure even still things the connection is good.  But the phase2 connection is red.

As mentioned.  This behavior did not occur yesterday. and the VPN configuration has been in place since 10:40am, but failed at 7pm

The only change made yesterday was enabling HA.  But the saved configs showing the aes256 setting was from over an hour after the cluster was formed.

[abarushka]

Hello,

You may consider to bring IPsec tunnel interface down. And then try to make configuration change on primary HA unit in CLI, bring IPsec tunnel interface up and check whether the issue persists.

[dbeitler]

Nice thought, but no change.

Brought the interface down and went to configure with "set proposal ?" and the only options which are shown are the various AES128 settings.  Still get the parse error, "Command fail. Return code -61" when trying to set aes256-sha256

Also to note, I am running in fips-cc mode.  Have been for a while.

[abarushka]

Hello,

I would also recommend to check whether phase 1 has AES 256 set. In case AES 128 is set under phase 1, AES 256 won't be available under phase 2.

[dbeitler]

Interesting.

What I had for phase 1:

set proposal aes128-sha1 aes256-sha-256 aes256-sha1

Removing the first and last, leaving aes256-sha256 enabled me to set phase 2 to aes256 as well.

Odd that it allowed me to set phase2 to aes256 before today.

[abarushka · Accepted solution]

Hello,

According to documentation (https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/ac683e6d-2981-11e9-94bf-005056... (page 23)):
"Phase 2 encryption strength does not exceed the Phase 1 encryption strength - e.g. if AES-128 is configured for Phase 1, then Phase 2 must also use a 128 bit encryption algorithm."

Mixing 128/256 in phase 1 configuration may potentially lead to the situation phase 1 AES 128 and phase 2 AES 256.