IPSec Negotiate SA Error

[#1]

Hello ALL, this is the 1st time I visit this forum and hoping to get some help on my site-to-site VPN connection setup... It' s a simple Policy-Based VPN using Pre-shared key between Forigate-60 & Checkpoint firewall. Getting " Negotiate SA Error: Peer' s id payloads do not match local policy." error on my Fortigate 60 device running FortiOS v3.0 trying to establish a IPSec tunnel (Preshared Key) with Checkpoint. I have done the same setup from few other sites with Fortigate-60 device running FortiOS v2.8 software. The same Preshared Key, Encrption/Authentication method. The only different I can tell between the 2 version of OS is the option under the Phase 2 " Quick Mode Identities" section. v2.8 offer options of " Use selectors from policy" , " Use wildcard selectors" & " Specify a selector" while there seems only the last option is available under FortiOS v3.0. Have been using the default " Use selectors from policy" option on the other v2.8 devices and they all worked fine. The event log on the v3.0 device showing... Responder: sent xx.xx.xx.xx aggressive mode message #1 (OK) Responder: parsed xx.xx.xx.xx afressive mode message #2 (DONE) Negotiate SA Error: Peer' s id payloads do not match local policy. Responder: parsed xx.xx.xx.xx quick mode message #1 (ERROR) ***repeating... Did I overlook any new features with v3.0 or, should I consider downgrade the OS on this device?? Any suggestion or comment is greatly appreciated.

[Hracio]

Assuming your P1&2 are ok, if you are using route based VPNs, check if in the involved FW Policies you are NAT.... Regards,. .!!

[#3]

Thanks, Hracio... I have been using Policy-based VPN by specifying certain internal network subnet to route through the encryption tunnel. This, works fine on my other Fortigate-60 units running OS v2.8. Guess I could do the same by creating a virtual interface using route based VPN?! Anything I should be awared? Thanks!

[rwpatterson]

There are some subtle differences between VPN tunnels on 2.8 and 3.00. One of the biggest is needing to use selectors to define the local and remote subnets. You could use policies on 2.8, not in 3.0. Try defining them in the advanced section on phase two, and get back to us.

[#5]

Thanks, Bob. I am with you but what if I have more than 20 differet networks to define? Should I go for Router-based VPN and define those network route through this virtual interface by specify them on the firewall policy? Sorry, I am new to this new concept and would appreciate any hints... Thanks!

[rwpatterson]

That is the part that is different in 3.0. Defining them only in the policy with an address entity will not work (with 0.0.0.0 selectors). The phase2 must now match the unit on the other end (any non Fortigate firewall/concentrator) using the selectors.

[#7]

Sounds like Bob gave you the answer. Here' s a bit more detail... On the tunnel you' re trying to bring up, edit the phase 2 proposal on your Fortigate with the 3.0OS. Hit the " Advanced" button and look at the bottom section titled Quick Mode Selector... if your source and destination addresses both say 0.0.0.0 - there' s your problem. You need to define these parameters. If, for example, the private network on the side of the FortiOS 3.0 firewall is 192.168.1.1-192.168.1.254 and the private network on the other end is 192.168.2.1-192.168.2.254, type in 192.168.1.0/24 under " Source address" and 192.168.2.0/24 under " Destination address" . Cheers, mj

[#8]

Appreciate for your kind advice and detail instructions, Bob & mj.... I believe I have no problem defining the Source address but the destination part... as I have close to 20 different subnet that I needed to access/specify like different subnets in the 10.0.0.0 network, 146.235.0.0, 192.168.0.0, etc... That' s why I have been using the firewall policies in v2.8 to address our needs. The VPN manual for v3.0 software does mentioned that we can left 0.0.0.0 & 0 to refer to everything?! Only for dedicate function by routing all traffic through the VPN tunnel?! Thanks again for all your help.... I am still confused...

[rwpatterson]

What I have done is hang multiple phase 2 definitions from a single phase 1. Once the key has been accepted, the correct tunnel will come up depending on the phase 2 networks that need to communicate through the link. Check out a snapshot of my monitor: Notice the first line. There are two ' selector pairs' for the one phase 1 definition in the first column. I have hung up to three successfully. I don' t see a reason why more could not be done. Good luck

[#10]

Great suggestion, Bob... Although I cannot view the picture... Do I still need the associated firewall policy to define the networks? I will give it a try and see how it works... Again, I appreciated.