IPSEC tunnel problem : no SA proposal chosen

[gilles007]

hello, i have a problem with a site-to-site VPN

i'm currently on fortigate VM-64 (Firmware Versionv5.0,build3608 (GA Patch 7))

the other end is a livebox pro (from france), which is emulating a cisco router

this is what i have in the logs on fortigate :

ike 0:aa23fec059ccba90/0000000000000000:2527: responder: main mode get 1st message...
ike 0:aa23fec059ccba90/0000000000000000:2527: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100
ike 0:aa23fec059ccba90/0000000000000000:2527: VID draft-ietf-ipsra-isakmp-xauth-06.txt 09002689DFD6B712
ike 0:aa23fec059ccba90/0000000000000000:2527: VID DPD AFCAD71368A1F1C96B8696FC77570100
ike 0:aa23fec059ccba90/0000000000000000:2527: VID RFC 3947 4A131C81070358455C5728F20E95452F
ike 0:aa23fec059ccba90/0000000000000000:2527: VID draft-ietf-ipsec-nat-t-ike-03 7D9419A65310CA6F2C179D9215529D56
ike 0:aa23fec059ccba90/0000000000000000:2527: VID draft-ietf-ipsec-nat-t-ike-02 CD60464335DF21F87CFDB2FC68B6A448
ike 0:aa23fec059ccba90/0000000000000000:2527: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F
ike 0:aa23fec059ccba90/0000000000000000:2527: VID draft-ietf-ipsec-nat-t-ike-00 4485152D18B6BBCD0BE8A8469579DDCC
ike 0:aa23fec059ccba90/0000000000000000:2527: incoming proposal:
ike 0:aa23fec059ccba90/0000000000000000:2527: proposal id = 0:
ike 0:aa23fec059ccba90/0000000000000000:2527: protocol id = ISAKMP:
ike 0:aa23fec059ccba90/0000000000000000:2527: trans_id = KEY_IKE.
ike 0:aa23fec059ccba90/0000000000000000:2527: encapsulation = IKE/none
ike 0:aa23fec059ccba90/0000000000000000:2527: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC.
ike 0:aa23fec059ccba90/0000000000000000:2527: type=OAKLEY_HASH_ALG, val=SHA.
ike 0:aa23fec059ccba90/0000000000000000:2527: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:aa23fec059ccba90/0000000000000000:2527: type=OAKLEY_GROUP, val=1536.
ike 0:aa23fec059ccba90/0000000000000000:2527: ISAKMP SA lifetime=86400
ike 0:aa23fec059ccba90/0000000000000000:2527: my proposal, gw From_BLB:
ike 0:aa23fec059ccba90/0000000000000000:2527: proposal id = 1:
ike 0:aa23fec059ccba90/0000000000000000:2527: protocol id = ISAKMP:
ike 0:aa23fec059ccba90/0000000000000000:2527: trans_id = KEY_IKE.
ike 0:aa23fec059ccba90/0000000000000000:2527: encapsulation = IKE/none
ike 0:aa23fec059ccba90/0000000000000000:2527: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC.
ike 0:aa23fec059ccba90/0000000000000000:2527: type=OAKLEY_HASH_ALG, val=SHA.
ike 0:aa23fec059ccba90/0000000000000000:2527: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:aa23fec059ccba90/0000000000000000:2527: type=OAKLEY_GROUP, val=1536.
ike 0:aa23fec059ccba90/0000000000000000:2527: ISAKMP SA lifetime=86400
ike 0:aa23fec059ccba90/0000000000000000:2527: negotiation failure
ike Negotiate ISAKMP SA Error: ike 0:aa23fec059ccba90/0000000000000000:2527: no SA proposal chosen

i got a difference on the proposal id

how could i resolve this ?

thanks for your response

[emnoc]

Check the proposals in the cfg  or change your side  and see if you  get  a match.

Ken

[gilles007]

i already did that

we tried multiple case 3des/aes128/aes256, md5/sha1but it's failing all time at P1

[ede_pfau]

It looks like all parameters are matching.

As phase1 still is failing check the PSK. Start with a very, very simple one, like '123456' (it's one of the most used btw).

Is the mode matching - aggressive vs. main mode?

It might help if you had some logs from the Cisco side as well.

[gilles007]

I'm not on the other side but we choose an easy password and i got a screenshot proof.

Unfortunately, it's not a real cisco but a box which can emulate cisco and we don't have logs.

On this box, mode dialog box is disable but it read "main".

We tested main and agressive mode.

I'm going to recheck all of this.

[ericli_FTNT]

Hi OP,

It still seems the proposal doesn't match. Please make sure the remote box is using the same or compatible proposal with your local Fortigate. Also post a successful IKE messages.

ike 0:6bd817795bd5d811/0000000000000000:814: responder: aggressive mode get 1st message... ike 0:6bd817795bd5d811/0000000000000000:814: VID RFC 3947 4A131C81070358455C5728F20E95452F ike 0:6bd817795bd5d811/0000000000000000:814: VID draft-ietf-ipsec-nat-t-ike-03 7D9419A65310CA6F2C179D9215529D56 ike 0:6bd817795bd5d811/0000000000000000:814: VID draft-ietf-ipsec-nat-t-ike-02 CD60464335DF21F87CFDB2FC68B6A448 ike 0:6bd817795bd5d811/0000000000000000:814: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F ike 0:6bd817795bd5d811/0000000000000000:814: VID draft-ietf-ipsec-nat-t-ike-01 16F6CA16E4A4066D83821A0F0AEAA862 ike 0:6bd817795bd5d811/0000000000000000:814: VID draft-ietf-ipsec-nat-t-ike-00 4485152D18B6BBCD0BE8A8469579DDCC ike 0:6bd817795bd5d811/0000000000000000:814: VID DPD AFCAD71368A1F1C96B8696FC77570100 ike 0:6bd817795bd5d811/0000000000000000:814: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3 ike 0:6bd817795bd5d811/0000000000000000:814: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3C0000000 ike 0:6bd817795bd5d811/0000000000000000:814: VID FORTIGATE 8299031757A36082C6A621DE00000000 ike 0::814: peer identifier IPV4_ADDR 10.6.30.252 ike 0:6bd817795bd5d811/0000000000000000:814: negotiation result ike 0:6bd817795bd5d811/0000000000000000:814: proposal id = 1: ike 0:6bd817795bd5d811/0000000000000000:814:   protocol id = ISAKMP: ike 0:6bd817795bd5d811/0000000000000000:814:      trans_id = KEY_IKE. ike 0:6bd817795bd5d811/0000000000000000:814:      encapsulation = IKE/none ike 0:6bd817795bd5d811/0000000000000000:814:         type=OAKLEY_ENCRYPT_ALG, val=DES_CBC. ike 0:6bd817795bd5d811/0000000000000000:814:         type=OAKLEY_HASH_ALG, val=SHA2_256. ike 0:6bd817795bd5d811/0000000000000000:814:         type=AUTH_METHOD, val=PRESHARED_KEY. ike 0:6bd817795bd5d811/0000000000000000:814:         type=OAKLEY_GROUP, val=MODP2048. ike 0:6bd817795bd5d811/0000000000000000:814: ISAKMP SA lifetime=86400 ike 0:6bd817795bd5d811/0000000000000000:814: SA proposal chosen, matched gateway vm