IKEv2 IPSEC with signature auth

[Parzysz]

Hi, I`m having problems with setting up IKEv2 IPSEC with remote site.

What I`ve done:

I`ve imported Certificate via GUI and whole Chain by which this certificate is signeg (Internal CA).

I`ve setup Custom Site-to-Site tunnel.

SA Policies do match.

Hovewer I can see in logs message saying:

ike 0:NVT_BIA:44590: reassembled fragmented message

ike 0:NVT_BIA:44590: initiator received AUTH msg

ike 0:NVT_BIA:44590: received peer identifier DER_ASN1_DN 'CN = RemoteIP, OU = VPN, O = CompanyName, C = UK'

ike 0:NVT_BIA:44590: Validating X.509 certificate

ike 0:NVT_BIA:44590: peer cert, subject='RemoteIP', issuer='IPSecCA'

ike 0:NVT_BIA:44590: peer ID verified

ike 0:NVT_BIA:44590: building fnbam peer candidate list

ike 0:NVT_BIA:44590: FNBAM_GROUP_ANY candidate ''

ike 0:NVT_BIA:44590: certificate validation pending

ike 0:NVT_BIA:44590: certificate validation complete

ike 0:NVT_BIA:44590: certificate validation succeeded

ike 0:NVT_BIA:44590: signature verification failed

[emnoc]

So I finally found the incredibly stupid and insecure solution to this: use SHA1 for the hashing algortithm in Phase 1 and Phase 2. Doing this (and making no other changes to the above config) causes the tunnel to come up without issue.

Did you  open any tickets with support ?And are you on the latest FortiOS version ?

[Boxheimer]

Hi,

Do we have a solution for that issue?

I have almost the same:

ike 0:XXXX-Test:367874: certificate validation complete ike 0:XXXX-Test:367874: certificate validation succeeded ike 0:XXXX-Test:367874: signature verification failed

Just with IKEv1 and only from Windows 1809 - when we use Windows 1803 and certificates from the same CA the tunnel works as expected.

We do the authentication with a RADIUS not with local peers.

P1 edit "XXXX-Test" set type dynamic set interface "port10" set authmethod signature set mode aggressive set peertype any set mode-cfg enable set ipv4-dns-server1 x.x.x.x set proposal aes128-sha256 aes256-sha256 3des-sha256 aes128-sha1 aes256-sha1 3des-sha1 set dpd on-idle set comments "VPN: XXXX-Test (Created by VPN wizard)" set wizard-type dialup-forticlient set xauthtype auto set authusrgrp "XXXX-Test" => RADIUS Group set certificate "XXXXXXXXXXXX" set net-device enable set ipv4-start-ip x.x.x.x set ipv4-end-ip x.x.x.x set ipv4-split-include "10.x.x.x.x/16" set save-password enable set client-auto-negotiate enable set client-keep-alive enable set dpd-retryinterval 5 next

P2 edit "XXXX-Test" set phase1name "XXXX-Test" set proposal aes128-sha1 aes256-sha1 3des-sha1 aes128-sha256 aes256-sha256 3des-sha256 set comments "VPN: XXXX-Test (Created by VPN wizard)" next

I have an open support case but now solution until now.