Hello,
in a transition from another manufacturers router to Fortigate I have to transpose IKEv2 Dial-In Client configurations into FortiOS 7.2.8. Although the necessary parameters should match. The connections do not work. Therefore I tried to troubleshoot the IKE connections with the following CLI commands:
diagnose debug application ike -1
diagnose vpn ike log-filter src-addr4 <remote WAN-IP>
alternatively: diagnose vpn ike log-filter dst-addr4 <local WAN-IP>
diagnose debug console timestamp enable
diagnose debug enable
But there are only empty lines. I double-checked that the dial-up client could reach the Fortigate and successfully pcap´ed.
Although I am new to FortiOS I would bet that there is a debug command to have a live view / monitor the setup negotiations of IKE phase 1 and IPSec phase 2 connections. But I have no clue how start these. Your hints would be appreciated.
The Admin-Guide https://docs.fortinet.com/document/fortigate/7.2.8/administration-guide/834425/understanding-vpn-rel... "Understanding VPN related Logs" mentions these logs, but I don´t know where to find them.
Any suggestions?
Here is a sample IKEv2 configuration. The NCP VPN software client f. Windows is used with it.
config vpn ipsec phase1-interface
edit "SAMPLE"
set type dynamic
set interface "port10"
set ike-version 2
set peertype one
set net-device disable
set mode-cfg enable
set proposal aes256-sha256
set dpd on-idle
set dhgrp 14
set peerid "xy@xyz.com"
set assign-ip-from dhcp
set dns-mode auto
set ipv4-split-include "INTRANET Subnet"
set psksecret ENC <Encrypted PSK>
set dpd-retryinterval 60
config vpn ipsec phase2-interface
edit "SAMPLE"
set phase1name "SAMPLE"
set proposal aes256-sha256
set dhgrp 14
next
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello @mhaneke ,
Thank you for contacting the Fortinet Forum portal.
Please use the below commands:
# diagnose debug disable
# diagnose vpn ike log-filter dst-addr4 [remote-peer] (public IP of user PC which you're trying to connect-remote-peer ip)
# diagnose debug console timestamp enable
# diagnose debug application ike -1
# diagnose debug enable
# diagnose debug disable ==========to stop debugs
-Your commands are correct but the IP address is wrong.
Best regards,
Manasa.
If you feel the above steps helped to resolve the issue mark the reply as solved so that other customers can get it easily while searching on similar scenarios.
Hello @mhaneke ,
No problem.
Did the new command work, have you tested them?
Best regards,
Manasa.
If you feel the above steps helped resolve the issue, mark the reply as solved so that other customers can get it easily while searching for similar scenarios.
Just as an additional hint:
if the VPN doesn't come up completely, it could be
1- that either the policy or the route to the remote network are missing
or
2- the DHCP server is not set to "type ipsec".
If the VPN comes up but traffic is not flowing, check the session setup with
"diag deb flow"
Get the params for setting up filters, output etc. from a KB article.
Hello @mhaneke ,
Thank you for contacting the Fortinet Forum portal.
Please use the below commands:
# diagnose debug disable
# diagnose vpn ike log-filter dst-addr4 [remote-peer] (public IP of user PC which you're trying to connect-remote-peer ip)
# diagnose debug console timestamp enable
# diagnose debug application ike -1
# diagnose debug enable
# diagnose debug disable ==========to stop debugs
-Your commands are correct but the IP address is wrong.
Best regards,
Manasa.
If you feel the above steps helped to resolve the issue mark the reply as solved so that other customers can get it easily while searching on similar scenarios.
Hello @manasa
thank You for Your quick and helpful answer.
I got it wrong. I inserted the WAN-IP of the Fortigate in
# diagnose vpn ike log-filterdst-addr4 [remote-peer]
best regards
Martin Haneke
Hello @mhaneke ,
No problem.
Did the new command work, have you tested them?
Best regards,
Manasa.
If you feel the above steps helped resolve the issue, mark the reply as solved so that other customers can get it easily while searching for similar scenarios.
Just as an additional hint:
if the VPN doesn't come up completely, it could be
1- that either the policy or the route to the remote network are missing
or
2- the DHCP server is not set to "type ipsec".
If the VPN comes up but traffic is not flowing, check the session setup with
"diag deb flow"
Get the params for setting up filters, output etc. from a KB article.
Hello@ede_pfau
You were right. The policy rulesets were missing, therefore the clients could not access the network, although the phase 2 SA and TSi were up and set correctly.
And the second error was, that I did not know that mode ike-cfg does not work together with DHCP and You have to choose an "Address Group" instead.
best regards
Martin Haneke
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1692 | |
1087 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.