Fortigate IPSEC with Barracuda NG

[JJ1]

Greetings all,

Has anyone tried to configured a IPSEC tunnel between a fortigate and a barracuda NG firewall? I've been breaking my head for almost 2 weeks now and cannot get this to work, even through P1 and P2 negotiate fine I cannot push traffic down the tunnel.

With IKEv1 innitialy I was getting "invalid ESP 1 (HMAC) SPI a9937646 seq 00000001", after changing from SHA256 to SHA1 I actually managed to get the paquets arriving at the fortigate side and being send back down the tunnel, but return packets never showed in the tunnel interface in the barracuda.

The problem seems to be some kind of missmatch between the two devices where they are not agreeing on the SPIs properly, I'm now trying with IKEv2 and I'm back where packets don't arrive at the fortigate tunnel, instead I get the following on the VPN debug:

ike 0:LAB: schedule auto-negotiate ike 0:LAB:1979:LAB2:30316: incoming child SA proposal: ike 0:LAB:1979:LAB2:30316: proposal id = 1: ike 0:LAB:1979:LAB2:30316: protocol = ESP: ike 0:LAB:1979:LAB2:30316: encapsulation = TUNNEL ike 0:LAB:1979:LAB2:30316: type=ENCR, val=3DES_CBC ike 0:LAB:1979:LAB2:30316: type=INTEGR, val=SHA ike 0:LAB:1979:LAB2:30316: PFS is disabled ike 0:LAB:1979:LAB2:30316: matched proposal id 1 ike 0:LAB:1979:LAB2:30316: proposal id = 1: ike 0:LAB:1979:LAB2:30316: protocol = ESP: ike 0:LAB:1979:LAB2:30316: encapsulation = TUNNEL ike 0:LAB:1979:LAB2:30316: type=ENCR, val=3DES_CBC ike 0:LAB:1979:LAB2:30316: type=INTEGR, val=SHA ike 0:LAB:1979:LAB2:30316: PFS is disabled ike 0:LAB:1979:LAB2:30316: lifetime=3600 ike 0:LAB:1979:LAB2:30316: set sa life soft seconds=3577. ike 0:LAB:1979:LAB2:30316: set sa life hard seconds=3600. ike 0:LAB:1979:LAB2:30316: IPsec SA selectors #src=1 #dst=1 ike 0:LAB:1979:LAB2:30316: src 0 4 0:192.168.20.0/255.255.255.0:0 ike 0:LAB:1979:LAB2:30316: dst 0 4 0:192.168.10.0/255.255.255.0:0 ike 0:LAB:1979:LAB2:30316: add IPsec SA: SPIs=a9937e3e/0350cd63 ike 0:LAB:1979:LAB2:30316: IPsec SA dec spi a9937e3e key 24:7E4A16B4C6BB4B98534F2E1BE40A1CA4A078799AFF91DA4B auth 20:DC67E1BE839B2CDB88CB161EB38D8EDBDC7018E0 ike 0:LAB:1979:LAB2:30316: IPsec SA enc spi 0350cd63 key 24:E4AE0FB1942340F291F294CF329569F27C532C8FB5A3632A auth 20:9140D81FE54E2DBBF209C9891B29ECFE41471A59 ike 0:LAB:1979:LAB2:30316: added IPsec SA: SPIs=a9937e3e/0350cd63 ike 0:LAB:1979:LAB2:30316: sending SNMP tunnel UP trap ike 0:LAB: invalid ESP 2 (padding) SPI a9937e3e seq 00000001 2 y.y.y.y->x.x.x.x:0 ike 0:LAB: invalid ESP 2 (padding) SPI a9937e3e seq 00000003 2 y.y.y.y->x.x.x.x:0 ike 0:LAB: invalid ESP 2 (padding) SPI a9937e3e seq 00000005 2 y.y.y.y->x.x.x.x:0 ike 0:LAB: invalid ESP 2 (padding) SPI a9937e3e seq 00000007 2 y.y.y.y->x.x.x.x:0 ike 0:LAB: invalid ESP 3 (pad length) SPI a9937e3e seq 00000009 2 y.y.y.y->x.x.x.x:0