Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Parzysz
New Contributor

IKEv2 IPSEC with signature auth

Hi, I`m having problems with setting up IKEv2 IPSEC with remote site.

What I`ve done:

I`ve imported Certificate via GUI and whole Chain by which this certificate is signeg (Internal CA).

I`ve setup Custom Site-to-Site tunnel.

SA Policies do match.

Hovewer I can see in logs message saying:

ike 0:NVT_BIA:44590: reassembled fragmented message
ike 0:NVT_BIA:44590: initiator received AUTH msg
ike 0:NVT_BIA:44590: received peer identifier DER_ASN1_DN 'CN = RemoteIP, OU = VPN, O = CompanyName, C = UK'
ike 0:NVT_BIA:44590: Validating X.509 certificate
ike 0:NVT_BIA:44590: peer cert, subject='RemoteIP', issuer='IPSecCA'
ike 0:NVT_BIA:44590: peer ID verified
ike 0:NVT_BIA:44590: building fnbam peer candidate list
ike 0:NVT_BIA:44590: FNBAM_GROUP_ANY candidate ''
ike 0:NVT_BIA:44590: certificate validation pending
ike 0:NVT_BIA:44590: certificate validation complete
ike 0:NVT_BIA:44590: certificate validation succeeded
ike 0:NVT_BIA:44590: signature verification failed
11 REPLIES 11
emnoc
Esteemed Contributor III

So I finally found the incredibly stupid and insecure solution to this: use SHA1 for the hashing algortithm in Phase 1 and Phase 2. Doing this (and making no other changes to the above config) causes the tunnel to come up without issue.

 

Did you  open any tickets with support ?And are you on the latest FortiOS version ?

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Boxheimer

Hi,

 

Do we have a solution for that issue?

I have almost the same:

ike 0:XXXX-Test:367874: certificate validation complete ike 0:XXXX-Test:367874: certificate validation succeeded ike 0:XXXX-Test:367874: signature verification failed

 

Just with IKEv1 and only from Windows 1809 - when we use Windows 1803 and certificates from the same CA the tunnel works as expected.

We do the authentication with a RADIUS not with local peers.

 

P1 edit "XXXX-Test" set type dynamic set interface "port10" set authmethod signature set mode aggressive set peertype any set mode-cfg enable set ipv4-dns-server1 x.x.x.x set proposal aes128-sha256 aes256-sha256 3des-sha256 aes128-sha1 aes256-sha1 3des-sha1 set dpd on-idle set comments "VPN: XXXX-Test (Created by VPN wizard)" set wizard-type dialup-forticlient set xauthtype auto set authusrgrp "XXXX-Test" => RADIUS Group set certificate "XXXXXXXXXXXX" set net-device enable set ipv4-start-ip x.x.x.x set ipv4-end-ip x.x.x.x set ipv4-split-include "10.x.x.x.x/16" set save-password enable set client-auto-negotiate enable set client-keep-alive enable set dpd-retryinterval 5 next

P2 edit "XXXX-Test" set phase1name "XXXX-Test" set proposal aes128-sha1 aes256-sha1 3des-sha1 aes128-sha256 aes256-sha256 3des-sha256 set comments "VPN: XXXX-Test (Created by VPN wizard)" next

 

I have an open support case but now solution until now.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors