IPSec Fortigate 600D Cisco CSR1000V

[lukis]

Hello,

I have problem with IPSec configuration between our Fortigate and customer Cisco CSR1000V. Unfortunately I am unable to get any logs or debugs from client side. In my opinion we have PSK mismatch, but client stays that his configuration is proper. Below is configuration from CSR and Fortigate

Cisco CSR

crypto isakmp policy 110 encr aes 256 hash sha256 group 14 ==================================================================== crypto ipsec transform-set aes_sha_256 esp-aes 256 esp-sha256-hmac ===================================================================== crypto map csrmap 44 ipsec-isakmp description xxx set peer 195.x.x.x set security-association lifetime seconds 28800 set transform-set aes_sha_256 set pfs group14 match address xxxACL ===================================================================== ip access-list extended AiutACL permit ip host 52.x.x.x host 192.168.40.50 permit ip host 192.168.40.50 host 52.x.x.x ===================================================================== crypto isakmp key 921cc54c99cf3a76db5ec804f2477864907400c7ee2c1cae24ed33800391032e address 195.x.x.x

Fortigate

show full vpn ipsec phase1-interface xxx config vpn ipsec phase1-interface edit "xxx" set type static set interface "port10" set ip-version 4 set ike-version 1 set local-gw 0.0.0.0 set keylife 86400 set authmethod psk set mode main set peertype any set mode-cfg disable set proposal aes256-sha256 aes128-sha256 aes256-sha1 aes128-sha1 set exchange-interface-ip disable set localid '' set localid-type keyid set negotiate-timeout 30 set fragmentation enable set dpd disable set forticlient-enforcement disable set comments '' set npu-offload enable set dhgrp 14 set suite-b disable set wizard-type custom set xauthtype disable set mesh-selector-type disable set idle-timeout disable set ha-sync-esp-seqno enable set auto-discovery-sender disable set auto-discovery-receiver disable set auto-discovery-forwarder disable set encapsulation none set nattraversal disable set remote-gw 54.x.x.x set monitor '' set add-gw-route disable set psksecret ENC XOPE8REqrbp+sCP7/dR7KA9+WkiPQNRPb7/ADmlCEaEMgisrGJ0/XkAQEGXwXAiHtLdwIV39GXcql+30ZJTO9OWV8zlsrdpgTqermQWitIWm3mmXOMHYf05q4vLj7OMkGsdPmCvPDnTE6+IYuooX1I85thzkoXt0pcDDyKaum6G6o2nYumb5WuEd4A/yAbq0Demlkw== set auto-negotiate enable next end

show full vpn ipsec phase2-interface xxx1 config vpn ipsec phase2-interface edit "Gasco1" set phase1name "xxx" set proposal aes256-sha256 set pfs enable set dhgrp 14 set replay enable set keepalive disable set auto-negotiate disable set auto-discovery-sender phase1 set auto-discovery-forwarder phase1 set keylife-type seconds set encapsulation tunnel-mode set comments '' set protocol 0 set src-addr-type ip set src-port 0 set dst-addr-type ip set dst-port 0 set keylifeseconds 43200 set src-start-ip 192.168.40.50 set dst-start-ip 52.x.x.x next end

Logs from our Fortigate:

Gxxx: schedule auto-negotiate Line 1224: ike 0:Gxxx:792912: initiator: main mode is sending 1st message... Line 1225: ike 0:Gxxx:792912: cookie 4e54b8c55cb37b6d/0000000000000000 Line 1226: ike 0:Gxxx:792912: out 4E54B8C55CB37B6D00000000000000000110020000000000000000BC0D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E010080030001800200048004000E0D000014AFCAD71368A1F1C96B8696FC775701000D00001412F5F28C457168A9702D9FE274CC02040D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE0005045D Line 1227: ike 0:Gxxx:792912: sent IKE msg (ident_i1send): 195.x.x.x:500->54.x.x.x:500, len=188, id=4e54b8c55cb37b6d/0000000000000000 Line 1231: ike 0:Gxxx:792912: ignoring unsupported INFORMATIONAL message 0. Line 1232: ike 0:Gxxx:792912: out 4E54B8C55CB37B6D00000000000000000110020000000000000000BC0D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E010080030001800200048004000E0D000014AFCAD71368A1F1C96B8696FC775701000D00001412F5F28C457168A9702D9FE274CC02040D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE0005045D Line 1233: ike 0:Gxxx:792912: sent IKE msg (P1_RETRANSMIT): 195.x.x.x:500->54.x.x.x:500, len=188, id=4e54b8c55cb37b6d/0000000000000000 Line 1240: ike 0:Gxxx:792912: out 4E54B8C55CB37B6D00000000000000000110020000000000000000BC0D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E010080030001800200048004000E0D000014AFCAD71368A1F1C96B8696FC775701000D00001412F5F28C457168A9702D9FE274CC02040D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE0005045D Line 1241: ike 0:Gxxx:792912: sent IKE msg (P1_RETRANSMIT): 195.x.x.x:500->54.x.x.x:500, len=188, id=4e54b8c55cb37b6d/0000000000000000 Line 1246: ike 0:Gxxx:792912: negotiation timeout, deleting Line 1247: ike 0:Gxxx: connection expiring due to phase1 down

Doesn't he need to add "authentication pre-share" in "crypto isakmp policy 110"

Thanks in advance Lukasz

[lukis]

Ok they added "authentication pre-share" as I asked and we moved forward. 

Now logs say as below:

ike 0:Gxxxx:797404: initiator: main mode is sending 1st message... ike 0:Gxxxx:797404: cookie b709c1b5daf7a82f/0000000000000000 ike 0:Gxxxx:797404: out B709C1B5DAF7A82F00000000000000000110020000000000000001240D0000B40000000100000001000000A8010100040300002801010000800B0001000C00040001518080010007800E010080030001800200048004000E0300002802010000800B0001000C00040001518080010007800E008080030001800200048004000E0300002803010000800B0001000C00040001518080010007800E010080030001800200028004000E0000002804010000800B0001000C00040001518080010007800E008080030001800200028004000E0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE0005045D ike 0:Gxxxx:797404: sent IKE msg (ident_i1send): 195.x.x.x:500->54.x.x.x:500, len=292, id=b709c1b5daf7a82f/0000000000000000 ike 0:Gxxxx:797404: initiator: main mode get 1st response... ike 0:Gxxxx:797404: negotiation result ike 0:Gxxxx:797404: proposal id = 1: ike 0:Gxxxx:797404: protocol id = ISAKMP: ike 0:Gxxxx:797404: trans_id = KEY_IKE. ike 0:Gxxxx:797404: encapsulation = IKE/none ike 0:Gxxxx:797404: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=256 ike 0:Gxxxx:797404: type=OAKLEY_HASH_ALG, val=SHA2_256. ike 0:Gxxxx:797404: type=AUTH_METHOD, val=PRESHARED_KEY. ike 0:Gxxxx:797404: type=OAKLEY_GROUP, val=MODP2048. ike 0:Gxxxx:797404: ISAKMP SA lifetime=86400 ike 0:Gxxxx:797404: out B709C1B5DAF7A82F8F604DC8C590167E0410020000000000000001340A00010401C163A0B8EA2A00B4ABD78CBE91B4C6E6DF563B15425F1EAD88DDE5A1A8C792F251E47B1CBFB85B1EA281558666C28CF8D81252436F3F2B9104D754AFA3B5F365338CA672C18D48512E66DFFF9EC310B5BCCCCEE33834BEF44711EB614B5DCDDF633855DBF52AFA2B3AC5FEBC4F5F0684F3E79549B9D3D070143969237E1FFD9196A2DA13F61C28743CA7314B2D3028DA69DC095C829B935EDBC7E047943017FBD792C5DAADD1C6CBD92DECD65C91197CB211554F0020D6539AABC135F1E7D4F669E0EF706150E8E7493C7EC966F38283067B1F63FC5C86C7B31ACCA07868BCE42C1FD73A08E0B4E914577B1B85DF70634F6A96E20409343173B6C3382965BC0000001408D5D7BC5806D04B3A89FC1016D0ECE4 ike 0:Gxxxx:797404: sent IKE msg (ident_i2send): 195.x.x.x:500->54.x.x.x:500, len=308, id=b709c1b5daf7a82f/8f604dc8c590167e ike 0:Gxxxx:797404: initiator: main mode get 2nd response... ike 0:Gxxxx:797404: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100 ike 0:Gxxxx:797404: peer supports UNITY ike 0:Gxxxx:797404: VID DPD AFCAD71368A1F1C96B8696FC77570100 ike 0:Gxxxx:797404: VID unknown (16): AFCAD71368A1F1C96B8696FC77570100 ike 0:Gxxxx:797404: VID draft-ietf-ipsra-isakmp-xauth-06.txt 09002689DFD6B712 ike 0:Gxxxx:797404: ISAKMP SA b709c1b5daf7a82f/8f604dc8c590167e key 32:B16D4A212B622AC4A25ED5D0B8FA5D3A5446EB1F056FEE25277DBCF33EBCFA03 ike 0:Gxxxx: connection expiring due to phase1 down

Is this proposal mismatch?