HASH verification failed

[mortirolo]

Hi all,

I trying to connect a site-to-site VPN with my customer who are running a Cisco ASA. Phase 1 seems to be complete, Phase 2 fails.

Speaking to my customer, so far I cannot see any discrepancies between our Phase 1 and 2 configs. When I debug my Fortigate I can see error "HASH verification failed" as below. Anyone know what this message would indicate? Debugs below

ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035: matched phase2 ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035: autokey ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035: my proposal: ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035: proposal id = 1: ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035:   protocol id = IPSEC_ESP: ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035:   PFS DH group = 5 ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035:      trans_id = ESP_AES (key_len = 256) ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035:      encapsulation = ENCAPSULATION_MODE_TUNNEL ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035:         type = AUTH_ALG, val=SHA1 ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035: incoming proposal: ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035: proposal id = 1: ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035:   protocol id = IPSEC_ESP: ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035:   PFS DH group = 5 ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035:      trans_id = ESP_AES (key_len = 256) ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035:      encapsulation = ENCAPSULATION_MODE_TUNNEL ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035:         type = AUTH_ALG, val=SHA1 ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035: negotiation result ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035: proposal id = 1: ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035:   protocol id = IPSEC_ESP: ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035:   PFS DH group = 5 ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035:      trans_id = ESP_AES (key_len = 256) ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035:      encapsulation = ENCAPSULATION_MODE_TUNNEL ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035:         type = AUTH_ALG, val=SHA1 ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035: set pfs=1536 ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035: using tunnel mode. ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035: add ISAKMP RESPONDER-LIFETIME 28800 ike 2:S2S-VPN-IGM:1039813: enc A621F8B608E95A78A33406BF80E3F17E08102001408E49F80000019001000018D55DD70303D4E9C832A5DC25C3B8067894F8E8050A00004400000001000000010000003801030401462A56120000002C010C00008001000180020E1080010002000200040046500080040001800500028003000580060100040000145D6926E38797C8137CD038CE36D131AE050000C4073FB60BD8A05674A33385F54D4BE95833798B8E6D3325C127C62EC951B052B8E5C7BC9E1C40555C7D0AE9789BA6B6594AE5F7B2206F0D3032D7865500DE1A2F0F70ED844788C81BE406F84402F686717D7E90F93E34DE6AFA70656D9C1108949C23501F66049570F22F1ABC1165E6A0A371190F95F8A84948F6931F20089728FF029F19C836C171BDC818225176825A87A66875A42D4C540F0AE096AF9D7E471BB29ECE65B6648BE6EA49989C22903FDDA75F3A33E9EEA76E1D361904A95FC10500000C010000000A222A070B00000C010000003E817418000000280000000101106000A621F8B608E95A78A33406BF80E3F17E800B00010002000400007080 ike 2:S2S-VPN-IGM:1039813: out A621F8B608E95A78A33406BF80E3F17E08102001408E49F80000019CD2807BB03E2288EFB4B061EBAF42189DE25F2C5FDE65B65FE28A0EDF8A786CA6A5360DD4918593ED495F879CE92A120CB1F4B565972A72890A35FF772BE106A7B4A8FFBB37BDA22FE7DD9C08D59439C8C765AD5C44D4860DE6DA1BAEEA19330C66275623984922362EF5A8F4A5FB305E153ADC3FA3E564F5BDE41003C2F8A2C53A1CEE2B83CF286D46CDD628B0B09EE91286E75D48AE1383FC8CFFB673F277847396A9A5C567923D1882CFD10BA90B421865D7C29B73B6D19383619F09EDD13113F922729ECDF26C604DF30EB5612A25EC04C636A58FE47518AD58580052524FB48E3A7C99F9343FD89A843962403433F6F6516A67ED46CCF299B15E713B47CC4D71611695BFAE94225427F20884C1B5E59D732899805CD1BC4F573121EB3F85FDCEAB469E6C90C0038F5129FBE819E7EA11DC0FD573E778550A6449140293F980FDF2C12343F3E087331A4182E441181AC571EA6BDD36AD736A357C036C69EEEA17B9362DBD63E53ED5A9E2C5C97CC4FACAE28D9D57DA9B54D139B5F669EC35 ike 2:S2S-VPN-IGM:1039813: sent IKE msg (quick_r1send): 195.x.x.x:500->194.x.x.x:500, len=412, id=a621f8b608e95a78/a33406bf80e3f17e:408e49f8 ike 2: comes 194.x.x.x:500->195.x.x.x:500,ifindex=59.... ike 2: IKEv1 exchange=Quick id=a621f8b608e95a78/a33406bf80e3f17e:408e49f8 len=60 ike 2: in A621F8B608E95A78A33406BF80E3F17E08102001408E49F80000003C948D0A845E968F962B666443253EBBF8807E10E3612832CF3FC4CAC90B2A75B7 ike 2:S2S-VPN-IGM:1039813: dec A621F8B608E95A78A33406BF80E3F17E08102001408E49F80000003C0000000400000000000000000000000000000000000000000000000000000000 ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035: HASH verification failed ike 2:S2S-VPN-IGM:1039813: info_send_n1, type 23 ike 2:S2S-VPN-IGM:1039813: enc A621F8B608E95A78A33406BF80E3F17E08100501D2266C38000000400B0000187240ACFEE444BB467256A74ADCB97DB6AE5F2BB70000000C0000000101000017 ike 2:S2S-VPN-IGM:1039813: out A621F8B608E95A78A33406BF80E3F17E08100501D2266C380000004C37EFD9E5AD0CDFCE3F3A52E2E1FB48812A2A83A8105B148198CE1666A2629BFC8E99E2212F68C7B854467831C99A2038 ike 2:S2S-VPN-IGM:1039813: sent IKE msg (p1_notify_23): 195.x.x.x:500->194.x.x.x:500, len=76, id=a621f8b608e95a78/a33406bf80e3f17e:d2266c38 ike 2:S2S-VPN-IGM:1039813: out A621F8B608E95A78A33406BF80E3F17E08102001408E49F80000019CD2807BB03E2288EFB4B061EBAF42189DE25F2C5FDE65B65FE28A0EDF8A786CA6A5360DD4918593ED495F879CE92A120CB1F4B565972A72890A35FF772BE106A7B4A8FFBB37BDA22FE7DD9C08D59439C8C765AD5C44D4860DE6DA1BAEEA19330C66275623984922362EF5A8F4A5FB305E153ADC3FA3E564F5BDE41003C2F8A2C53A1CEE2B83CF286D46CDD628B0B09EE91286E75D48AE1383FC8CFFB673F277847396A9A5C567923D1882CFD10BA90B421865D7C29B73B6D19383619F09EDD13113F922729ECDF26C604DF30EB5612A25EC04C636A58FE47518AD58580052524FB48E3A7C99F9343FD89A843962403433F6F6516A67ED46CCF299B15E713B47CC4D71611695BFAE94225427F20884C1B5E59D732899805CD1BC4F573121EB3F85FDCEAB469E6C90C0038F5129FBE819E7EA11DC0FD573E778550A6449140293F980FDF2C12343F3E087331A4182E441181AC571EA6BDD36AD736A357C036C69EEEA17B9362DBD63E53ED5A9E2C5C97CC4FACAE28D9D57DA9B54D139B5F669EC35 ike 2:S2S-VPN-IGM:1039813: sent IKE msg (P2_RETRANSMIT): 195.x.x.x:500->194.x.x.x:500, len=412, id=a621f8b608e95a78/a33406bf80e3f17e:408e49f8 ike 2: comes 194.x.x.x:500->195.x.x.x:500,ifindex=59.... ike 2: IKEv1 exchange=Quick id=a621f8b608e95a78/a33406bf80e3f17e:408e49f8 len=60 ike 2: in A621F8B608E95A78A33406BF80E3F17E08102001408E49F80000003C948D0A845E968F962B666443253EBBF8807E10E3612832CF3FC4CAC90B2A75B7 ike 2:S2S-VPN-IGM:1039813: dec A621F8B608E95A78A33406BF80E3F17E08102001408E49F80000003C0000000400000000000000000000000000000000000000000000000000000000 ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035: HASH verification failed ike 2:S2S-VPN-IGM:1039813: info_send_n1, type 23

[mortirolo]

I resolved myself in the end!

You'll see the last message........

ike 2:S2S-VPN-IGM:1039813:S2S-VPN-IGM-P2-P10:10385035: add ISAKMP RESPONDER-LIFETIME 28800

thereafter the session never comes up.

I asked the client to debug, they sent me their output and I could see their Phase 1 lifetime was 86400 instead of 28800.

[Rewanta_FTNT]

> I asked the client to debug, they sent me their output and I could see their Phase 1 lifetime was 86400 instead of 28800. this is a known issue  with asa and fortios 5.0.9 (may be even 5.0.8) if the lifetimes are different, FGT sends the payload notifications as the lifetime are different and ASA behaves differently and flags up as hash failed. when lifetime is same, no payload notification  will be sent so no hash failure.