Fortigate Cisco7206 ipsec tunnel

[#1]

Hi All i' m having trouble to establish IPsec VPN connection the cisco config: crypto isakmp policy 10 encr 3des authentication pre-share group 2 lifetime 28800 crypto isakmp key RRsatDEMO address xx.xx.xx.xx ! crypto ipsec transform-set ESP_3DES_SHA esp-3des esp-sha-hmac ! crypto map VPN 10 ipsec-isakmp set peer yy.yy.yy.yy set transform-set ESP_3DES_SHA set pfs group5 match address 101 ! interface FastEthernet0/0 ip address xx.xx.xx.xx no ip route-cache cef no ip route-cache no ip mroute-cache duplex full crypto map VPN access-list 101 permit ip 192.168.202.80 0.0.0.8 192.16.160.0 0.0.0.255 the error log on the FG Received error notification from peer: NO-PROPOSAL-CHOSEN thanks in advanced

[#2]

the cisco Log 15:54:22: ISAKMP:(1100): retransmitting phase 1 MM_KEY_EXCH... 15:54:22: ISAKMP (1100): incrementing error counter on sa, attempt 5 of 5: retransmit phase 1 15:54:22: ISAKMP:(1100): retransmitting phase 1 MM_KEY_EXCH 15:54:22: ISAKMP:(1100): sending packet to 62.128.58.141 my_port 500 peer_port 500 (R) MM_KEY_EXCH 15:54:22: ISAKMP:(1100):Sending an IKE IPv4 Packet. 15:54:23: ISAKMP (1100): received packet from 62.128.58.141 dport 500 sport 500 Global (R) MM_KEY_EXCH 15:54:23: ISAKMP:(1100): phase 1 packet is a duplicate of a previous packet. 15:54:23: ISAKMP:(1100): retransmission skipped for phase 1 (time since last transmission 144) 15:54:25: ISAKMP:(1099):purging SA., sa=6744943C, delme=6744943C 15:54:28: ISAKMP (1100): received packet from 62.128.58.141 dport 500 sport 500 Global (R) MM_KEY_EXCH 15:54:28: ISAKMP:(1100): phase 1 packet is a duplicate of a previous packet. 15:54:28: ISAKMP:(1100): retransmitting due to retransmit phase 1 15:54:28: ISAKMP:(1100): retransmitting phase 1 MM_KEY_EXCH... 15:54:28: ISAKMP:(1100):peer does not do paranoid keepalives. 15:54:28: ISAKMP:(1100):deleting SA reason " Death by retransmission P1" state (R) MM_KEY_EXCH (peer 62.128.58.141) 15:54:28: ISAKMP:(1100):deleting SA reason " Death by retransmission P1" state (R) MM_KEY_EXCH (peer 62.128.58.141) 15:54:28: ISAKMP: Unlocking peer struct 0x668CAD10 for isadb_mark_sa_deleted(), count 0 15:54:28: ISAKMP: Deleting peer node by peer_reap for 62.128.58.141: 668CAD10 15:54:28: ISAKMP:(1100):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL 15:54:28: ISAKMP:(1100):Old State = IKE_R_MM4 New State = IKE_DEST_SA

[emnoc]

thanks in advanced Rate this post! Date: 12/24/2010 10:49:44 PM View User' s Profile E-mail: ariel.b Send Private Message Add Member To Contact List Block this guy and hide his messages ariel.b New Member Posts: 2 Score: 0 Joined: 12/24/2010 RE: Fortigate Cisco7206 ipsec tunnel (in reply to ariel.b) Reply Forward New Messages the cisco Log

So how does the FGT cfg look like? I would double the check the p1/p2 proposals on the FGT. If you have multiple proposal enabled, I would try to narrow down to just 3des-sha Other items to look at; Ensure the local subnet is not being nat' d Make sure pfs is enable for re-neg for phase2 Ike version 1 is enable on the FGT -only conduct your diag vpn on the fgt and debug crypto on the IOS-router if you still need further diagnostics.