Hello Guys, i am facing a challenge that i can only solve with your help. Please support me. I want to establish a VPN connection between my Fortigate 50E and a (Linux) Hosted root server. I've tested it with several instructions but can't get any further. In Fortigate the connection is UP but in the logs it says " negotiate failure progress IPsec phase 2". Strongswan displays the following message: Routed Connections: FortiGate{1}: ROUTED, TUNNEL, reqid 1 FortiGate{1}: 85.XXX.XX.XXX/32 === 192.168.90.0/24 Security Associations (1 up, 0 connecting): FortiGate[1]: ESTABLISHED 9 minutes ago, 85.XXX.XX.XXX[85.XXX.XX.XXX]...88.XX.XXX.XX[88.XX.XXX.XX] The hosted root server has no subnet but only a public IP address. The ipsec.conf looks like this: config setup # strictcrlpolicy=yes # uniqueids = no conn FortiGate authby=secret type=tunnel auto=route compress=no left=85.XXX.XX.XXX leftsubnet=85.XXX.XX.XXX/32 right=88.XXX.XXX.XX rightsubnet=192.168.90.0/24 leftfirewall=no keyexchange=ikev1 ike=aes256-sha256-ecp521 esp=aes256-sha256-ecp521 The /etc/sysctl.conf looks like this: net.ipv4.ip_forward=1 net.ipv4.conf.all.accept_redirects = 0 net.ipv6.conf.all.accept_redirects = 0 If you need more data, just write ;-) Thanks for your help!
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi
I seen you Pm here's my 200B and what I have
conn FGT200B type=tunnel keyexchange=ikev1 auto=start ike=aes128-sha1;modp1024 # left = local left="x.x.x.x" leftsubnet=192.0.2.0/255.255.255.0 # right = remote right=y.y.y.y. rightsubnet=192.0.3.0/255.255.255.0 esp=aes128-sha1 keyingtries=%forever
The fortigate configurations looks like this;
config vpn ipsec phase1-interface edit strongvpn set interface " wan1" set dhgrp 2 set proposal aes128-sha1 set dpd disable set remote-gw x.x.x.x set psksecret m@ster0lock next end config vpn ipsec phase2-interface edit " strongvpn-p2-1" set auto-negotiate enable set keepalive enable set pfs disable set phase1name strongvpn set proposal aes128-sha1 set replay disable set dst-subnet 192.0.2.0/24 set src-subnet 192.0.3.0/24 set keylifeseconds 3600 next end
I have not done a ECP tunnel so that could be a issue. I would also use DHGRP 14 or higher btw
Ken Felix
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.