Unlock Exclusive Benefits
Join Our Community Today!
Join our Community and post in the forum to earn your exclusive badge; celebrating 3 years of the Fortinet Community!
LOGIN/REGISTER
CONTINUE AS A GUEST
- Forums
- Knowledge Base
- Customer Service
- Internal Article Nominations
- FortiGate
- FortiClient
- FortiAP
- FortiAnalyzer
- FortiADC
- FortiAuthenticator
- FortiBridge
- FortiCache
- FortiCarrier
- FortiCASB
- FortiConnect
- FortiConverter
- FortiCNP
- FortiDAST
- FortiDDoS
- FortiDB
- FortiDNS
- FortiDLP
- FortiDevSec
- FortiDeceptor
- FortiDirector
- FortiEDR
- FortiExtender
- FortiGate Cloud
- FortiHypervisor
- FortiGuard
- FortiInsight
- FortiIsolator
- FortiMail
- FortiMonitor
- FortiManager
- FortiNAC
- FortiNAC-F
- FortiNDR (on-premise)
- FortiNDRCloud
- FortiPAM
- FortiPhish
- FortiPortal
- FortiProxy
- FortiRecon
- FortiRecorder
- FortiSRA
- FortiSandbox
- FortiSASE
- FortiScan
- FortiSIEM
- FortiSOAR
- FortiSwitch
- FortiTester
- FortiToken
- FortiVoice
- FortiWAN
- FortiWeb
- FortiWebCloud
- Lacework
- Wireless Controller
- RMA Information and Announcements
- FortiCloud Products
- ZTNA
- 4D Documents
- Customer Service
- Community Groups
- Blogs
Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
- Fortinet Community
- Forums
- Support Forum
- Re: IPSec tunnel error : no SA proposal chosen
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
IPSec tunnel error : no SA proposal chosen
Hi,
I try to implement site to site vpn between 2 Fortigate in my lab but I got this error on both side :
ike Negotiate ISAKMP SA Error: ike 0:ffd4573d1a2ff133/0000000000000000:220: no SA proposal chosen
Commands output :
Hub # show vpn ipsec phase1-interface
config vpn ipsec phase1-interface
edit "VPN-to-spoke"
set interface "port2"
set peertype any
set net-device disable
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set comments "VPN: VPN-to-spoke (Created by VPN wizard)"
set wizard-type static-fortigate
set remote-gw Spoke_IP
set psksecret ENC pkX9mSvmif/AZCPktG9xlCHmSNyAmQ2L3IigVETGNrOEVgH1t22s1u6cEl2aLk+V/WMJn7Qnm246 TgPqCL6nchuxAdm0bbBpKQvAODxUp72Vfror9YyanMzw2iwhFEIG2KABhJnUGGgkIWql3lxk0SUmefRrVdRahgC2HLiGJ0+TaqhF3U sjhCTKE5K6zP4ACd1yCQ==
next
end
Hub # show vpn ipsec phase2-interface
config vpn ipsec phase2-interface
edit "VPN-to-spoke"
set phase1name "VPN-to-spoke"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20p oly1305
set comments "VPN: VPN-to-spoke (Created by VPN wizard)"
set src-addr-type name
set dst-addr-type name
set src-name "VPN-to-spoke_local"
set dst-name "VPN-to-spoke_remote"
next
end
Spoke # show vpn ipsec phase2-interface
config vpn ipsec phase2-interface
edit "VPN-to-hub"
set phase1name "VPN-to-hub"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20p oly1305
set comments "VPN: VPN-to-hub (Created by VPN wizard)"
set src-addr-type name
set dst-addr-type name
set src-name "VPN-to-hub_local"
set dst-name "VPN-to-hub_remote"
next
end
Spoke # show vpn ipsec phase1-interface
config vpn ipsec phase1-interface
edit "VPN-to-hub"
set interface "port2"
set peertype any
set net-device disable
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set comments "VPN: VPN-to-hub (Created by VPN wizard)"
set wizard-type static-fortigate
set remote-gw Hub_IP
set psksecret ENC kEfDI1zLYsPFkFz9bysnnV0332UzuFtMFjLdcv2BRD9F9tm6zF7Ipe5LaEukmtEY0Gc duvY5pP86mlEQfHi3Bl0y5N6QPXWQ5IwlPnc2f+CAy4q3nNF5vRZlKrxKk0OU2JCmWxC7TiNIJG2Hxczn4YvtnuFiYe6p ay5y/kcM7Myp2ZoW0aXU1CYIlfB5MBiyxMwinw==
next
end
The proposal are the same. I can ping Spoke from Hub and Hub from Spoke so I don't know what is the problem. If someone could help me, I would be thankful.
it's the first time I use a Fortigate so maybe I missed something
Hugo
Solved! Go to Solution.
Nominate a Forum Post for Knowledge Article Creation
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
1 Solution
Created on 04-25-2024 07:24 AM Edited on 04-25-2024 07:29 AM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @hugo-spie ,
It seems interesting. Both site IPs look different.
HUB: ike 0: comes 2.2.2.5:500->77.77.77.254:500,
Spoke: ike 0: comes 2.2.2.25:500->99.99.99.254:500,ifindex=4,vrf=0
If you get a trial license from Fortinet, no need to use lower encryption. What I said is valid for an eval license.
Can you start over and follow this document for the ipsec configuration?
P.S
I found one video about ipsec configuration on two FortiGates. You can also follow this video.
https://www.youtube.com/watch?v=MHfjI13WiNI&ab_channel=ToThePointFortinet
If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it
easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
6 REPLIES 6
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you using trial VM FortiGates ?
"jack of all trades, master of none"
"jack of all trades, master of none"
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, I use 60 days temporary licences from FortiNet. Is it a problem ?
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @hugo-spie ,
Do you have a valid license on both sides? If you use a eval license you need to create vpn with lower encryption keys. Because the eval license doesn't support all encryption algorithms.
Can you share these command outputs with us?
diagnose debug application ike -1
diagnose debug enable
Also, can you try to configure custom ipsec vpn instead of vpn wizard?
If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it
easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, I use 60 days temporary licences from FortiNet. Do you have a link for the documention about creating vpn with lower encryption keys please ?
Spoke # ike 0: comes 2.2.2.25:500->99.99.99.254:500,ifindex=4,vrf=0....
ike 0: IKEv1 exchange=Identity Protection id=fd920908b9fe5f5f/0000000000000000 len=632 vrf=0
ike 0: in FD920908B9FE5F5F00000000000000000110020000000000000002780D000154000000010000000100000148010100080300002801010000800B0001000C00040001518080010007800E008080030001800200048004000E0300002802010000800B0001000C00040001518080010007800E00808003000180020004800400050300002803010000800B0001000C00040001518080010007800E010080030001800200048004000E0300002804010000800B0001000C00040001518080010007800E01008003000180020004800400050300002805010000800B0001000C00040001518080010007800E008080030001800200028004000E0300002806010000800B0001000C00040001518080010007800E00808003000180020002800400050300002807010000800B0001000C00040001518080010007800E010080030001800200028004000E0000002808010000800B0001000C00040001518080010007800E01008003000180020002800400050D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000149B15E65A871AFF342666623BA5022E600D000014CA4A4CBB12EAB6C58C57067C2E6537860D000014A58FEC5036F57B21E8B499E336C76EE60D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000
ike 0:fd920908b9fe5f5f/0000000000000000:1291: responder: main mode get 1st message...
ike 0:fd920908b9fe5f5f/0000000000000000:1291: VID RFC 3947 4A131C81070358455C5728F20E95452F
ike 0:fd920908b9fe5f5f/0000000000000000:1291: VID draft-ietf-ipsec-nat-t-ike-03 7D9419A65310CA6F2C179D9215529D56
ike 0:fd920908b9fe5f5f/0000000000000000:1291: VID draft-ietf-ipsec-nat-t-ike-02 CD60464335DF21F87CFDB2FC68B6A448
ike 0:fd920908b9fe5f5f/0000000000000000:1291: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F
ike 0:fd920908b9fe5f5f/0000000000000000:1291: VID draft-ietf-ipsec-nat-t-ike-01 16F6CA16E4A4066D83821A0F0AEAA862
ike 0:fd920908b9fe5f5f/0000000000000000:1291: VID draft-ietf-ipsec-nat-t-ike-00 4485152D18B6BBCD0BE8A8469579DDCC
ike 0:fd920908b9fe5f5f/0000000000000000:1291: VID DPD AFCAD71368A1F1C96B8696FC77570100
ike 0:fd920908b9fe5f5f/0000000000000000:1291: VID Fortinet Auto-Discovery Sender 9B15E65A871AFF342666623BA5022E60
ike 0:fd920908b9fe5f5f/0000000000000000:1291: VID Fortinet Auto-Discovery Receiver CA4A4CBB12EAB6C58C57067C2E653786
ike 0:fd920908b9fe5f5f/0000000000000000:1291: VID Fortinet Exchange Interface IP A58FEC5036F57B21E8B499E336C76EE6
ike 0:fd920908b9fe5f5f/0000000000000000:1291: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3
ike 0:fd920908b9fe5f5f/0000000000000000:1291: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3C0000000
ike 0:fd920908b9fe5f5f/0000000000000000:1291: VID FORTIGATE 8299031757A36082C6A621DE00000000
ike 0:fd920908b9fe5f5f/0000000000000000:1291: incoming proposal:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: proposal id = 0:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: protocol id = ISAKMP:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: trans_id = KEY_IKE.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: encapsulation = IKE/none
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_HASH_ALG, val=SHA2_256.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_GROUP, val=MODP2048.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: ISAKMP SA lifetime=86400
ike 0:fd920908b9fe5f5f/0000000000000000:1291: proposal id = 0:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: protocol id = ISAKMP:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: trans_id = KEY_IKE.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: encapsulation = IKE/none
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_HASH_ALG, val=SHA2_256.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_GROUP, val=MODP1536.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: ISAKMP SA lifetime=86400
ike 0:fd920908b9fe5f5f/0000000000000000:1291: proposal id = 0:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: protocol id = ISAKMP:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: trans_id = KEY_IKE.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: encapsulation = IKE/none
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=256
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_HASH_ALG, val=SHA2_256.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_GROUP, val=MODP2048.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: ISAKMP SA lifetime=86400
ike 0:fd920908b9fe5f5f/0000000000000000:1291: proposal id = 0:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: protocol id = ISAKMP:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: trans_id = KEY_IKE.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: encapsulation = IKE/none
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=256
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_HASH_ALG, val=SHA2_256.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_GROUP, val=MODP1536.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: ISAKMP SA lifetime=86400
ike 0:fd920908b9fe5f5f/0000000000000000:1291: proposal id = 0:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: protocol id = ISAKMP:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: trans_id = KEY_IKE.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: encapsulation = IKE/none
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_HASH_ALG, val=SHA.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_GROUP, val=MODP2048.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: ISAKMP SA lifetime=86400
ike 0:fd920908b9fe5f5f/0000000000000000:1291: proposal id = 0:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: protocol id = ISAKMP:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: trans_id = KEY_IKE.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: encapsulation = IKE/none
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_HASH_ALG, val=SHA.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_GROUP, val=MODP1536.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: ISAKMP SA lifetime=86400
ike 0:fd920908b9fe5f5f/0000000000000000:1291: proposal id = 0:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: protocol id = ISAKMP:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: trans_id = KEY_IKE.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: encapsulation = IKE/none
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=256
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_HASH_ALG, val=SHA.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_GROUP, val=MODP2048.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: ISAKMP SA lifetime=86400
ike 0:fd920908b9fe5f5f/0000000000000000:1291: proposal id = 0:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: protocol id = ISAKMP:
ike 0:fd920908b9fe5f5f/0000000000000000:1291: trans_id = KEY_IKE.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: encapsulation = IKE/none
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=256
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_HASH_ALG, val=SHA.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: type=OAKLEY_GROUP, val=MODP1536.
ike 0:fd920908b9fe5f5f/0000000000000000:1291: ISAKMP SA lifetime=86400
ike 0:fd920908b9fe5f5f/0000000000000000:1291: negotiation failure
ike Negotiate ISAKMP SA Error: ike 0:fd920908b9fe5f5f/0000000000000000:1291: no SA proposal chosen
ike 0:VPN-to-hub:1289: out 0089726556465204000000000000000001100200000000000000023C0D000154000000010000000100000148010100080300002801010000800B0001000C00040001518080010007800E008080030001800200048004000E0300002802010000800B0001000C00040001518080010007800E00808003000180020004800400050300002803010000800B0001000C00040001518080010007800E010080030001800200048004000E0300002804010000800B0001000C00040001518080010007800E01008003000180020004800400050300002805010000800B0001000C00040001518080010007800E008080030001800200028004000E0300002806010000800B0001000C00040001518080010007800E00808003000180020002800400050300002807010000800B0001000C00040001518080010007800E010080030001800200028004000E0000002808010000800B0001000C00040001518080010007800E01008003000180020002800400050D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000
ike 0:VPN-to-hub:1289: sent IKE msg (P1_RETRANSMIT): 2.2.2.5:500->77.77.77.254:500, len=572, vrf=0, id=0089726556465204/0000000000000000
Hub # ike shrank heap by 159744 bytes
ike 0:VPN-to-spoke:1286: out F35F06DE9334D5A300000000000000000110020000000000000002780D000154000000010000000100000148010100080300002801010000800B0001000C00040001518080010007800E008080030001800200048004000E0300002802010000800B0001000C00040001518080010007800E00808003000180020004800400050300002803010000800B0001000C00040001518080010007800E010080030001800200048004000E0300002804010000800B0001000C00040001518080010007800E01008003000180020004800400050300002805010000800B0001000C00040001518080010007800E008080030001800200028004000E0300002806010000800B0001000C00040001518080010007800E00808003000180020002800400050300002807010000800B0001000C00040001518080010007800E010080030001800200028004000E0000002808010000800B0001000C00040001518080010007800E01008003000180020002800400050D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000149B15E65A871AFF342666623BA5022E600D000014CA4A4CBB12EAB6C58C57067C2E6537860D000014A58FEC5036F57B21E8B499E336C76EE60D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000
ike 0:VPN-to-spoke:1286: sent IKE msg (P1_RETRANSMIT): 2.2.2.25:500->99.99.99.254:500, len=632, vrf=0, id=f35f06de9334d5a3/0000000000000000
ike 0: comes 2.2.2.5:500->77.77.77.254:500,ifindex=4,vrf=0....
ike 0: IKEv1 exchange=Identity Protection id=13d44c5be41bf62a/0000000000000000 len=572 vrf=0
ike 0: in 13D44C5BE41BF62A000000000000000001100200000000000000023C0D000154000000010000000100000148010100080300002801010000800B0001000C00040001518080010007800E008080030001800200048004000E0300002802010000800B0001000C00040001518080010007800E00808003000180020004800400050300002803010000800B0001000C00040001518080010007800E010080030001800200048004000E0300002804010000800B0001000C00040001518080010007800E01008003000180020004800400050300002805010000800B0001000C00040001518080010007800E008080030001800200028004000E0300002806010000800B0001000C00040001518080010007800E00808003000180020002800400050300002807010000800B0001000C00040001518080010007800E010080030001800200028004000E0000002808010000800B0001000C00040001518080010007800E01008003000180020002800400050D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000
ike 0:13d44c5be41bf62a/0000000000000000:1290: responder: main mode get 1st message...
ike 0:13d44c5be41bf62a/0000000000000000:1290: VID RFC 3947 4A131C81070358455C5728F20E95452F
ike 0:13d44c5be41bf62a/0000000000000000:1290: VID draft-ietf-ipsec-nat-t-ike-03 7D9419A65310CA6F2C179D9215529D56
ike 0:13d44c5be41bf62a/0000000000000000:1290: VID draft-ietf-ipsec-nat-t-ike-02 CD60464335DF21F87CFDB2FC68B6A448
ike 0:13d44c5be41bf62a/0000000000000000:1290: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F
ike 0:13d44c5be41bf62a/0000000000000000:1290: VID draft-ietf-ipsec-nat-t-ike-01 16F6CA16E4A4066D83821A0F0AEAA862
ike 0:13d44c5be41bf62a/0000000000000000:1290: VID draft-ietf-ipsec-nat-t-ike-00 4485152D18B6BBCD0BE8A8469579DDCC
ike 0:13d44c5be41bf62a/0000000000000000:1290: VID DPD AFCAD71368A1F1C96B8696FC77570100
ike 0:13d44c5be41bf62a/0000000000000000:1290: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3
ike 0:13d44c5be41bf62a/0000000000000000:1290: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3C0000000
ike 0:13d44c5be41bf62a/0000000000000000:1290: VID FORTIGATE 8299031757A36082C6A621DE00000000
ike 0:13d44c5be41bf62a/0000000000000000:1290: incoming proposal:
ike 0:13d44c5be41bf62a/0000000000000000:1290: proposal id = 0:
ike 0:13d44c5be41bf62a/0000000000000000:1290: protocol id = ISAKMP:
ike 0:13d44c5be41bf62a/0000000000000000:1290: trans_id = KEY_IKE.
ike 0:13d44c5be41bf62a/0000000000000000:1290: encapsulation = IKE/none
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_HASH_ALG, val=SHA2_256.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_GROUP, val=MODP2048.
ike 0:13d44c5be41bf62a/0000000000000000:1290: ISAKMP SA lifetime=86400
ike 0:13d44c5be41bf62a/0000000000000000:1290: proposal id = 0:
ike 0:13d44c5be41bf62a/0000000000000000:1290: protocol id = ISAKMP:
ike 0:13d44c5be41bf62a/0000000000000000:1290: trans_id = KEY_IKE.
ike 0:13d44c5be41bf62a/0000000000000000:1290: encapsulation = IKE/none
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_HASH_ALG, val=SHA2_256.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_GROUP, val=MODP1536.
ike 0:13d44c5be41bf62a/0000000000000000:1290: ISAKMP SA lifetime=86400
ike 0:13d44c5be41bf62a/0000000000000000:1290: proposal id = 0:
ike 0:13d44c5be41bf62a/0000000000000000:1290: protocol id = ISAKMP:
ike 0:13d44c5be41bf62a/0000000000000000:1290: trans_id = KEY_IKE.
ike 0:13d44c5be41bf62a/0000000000000000:1290: encapsulation = IKE/none
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=256
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_HASH_ALG, val=SHA2_256.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_GROUP, val=MODP2048.
ike 0:13d44c5be41bf62a/0000000000000000:1290: ISAKMP SA lifetime=86400
ike 0:13d44c5be41bf62a/0000000000000000:1290: proposal id = 0:
ike 0:13d44c5be41bf62a/0000000000000000:1290: protocol id = ISAKMP:
ike 0:13d44c5be41bf62a/0000000000000000:1290: trans_id = KEY_IKE.
ike 0:13d44c5be41bf62a/0000000000000000:1290: encapsulation = IKE/none
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=256
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_HASH_ALG, val=SHA2_256.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_GROUP, val=MODP1536.
ike 0:13d44c5be41bf62a/0000000000000000:1290: ISAKMP SA lifetime=86400
ike 0:13d44c5be41bf62a/0000000000000000:1290: proposal id = 0:
ike 0:13d44c5be41bf62a/0000000000000000:1290: protocol id = ISAKMP:
ike 0:13d44c5be41bf62a/0000000000000000:1290: trans_id = KEY_IKE.
ike 0:13d44c5be41bf62a/0000000000000000:1290: encapsulation = IKE/none
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_HASH_ALG, val=SHA.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_GROUP, val=MODP2048.
ike 0:13d44c5be41bf62a/0000000000000000:1290: ISAKMP SA lifetime=86400
ike 0:13d44c5be41bf62a/0000000000000000:1290: proposal id = 0:
ike 0:13d44c5be41bf62a/0000000000000000:1290: protocol id = ISAKMP:
ike 0:13d44c5be41bf62a/0000000000000000:1290: trans_id = KEY_IKE.
ike 0:13d44c5be41bf62a/0000000000000000:1290: encapsulation = IKE/none
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_HASH_ALG, val=SHA.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_GROUP, val=MODP1536.
ike 0:13d44c5be41bf62a/0000000000000000:1290: ISAKMP SA lifetime=86400
ike 0:13d44c5be41bf62a/0000000000000000:1290: proposal id = 0:
ike 0:13d44c5be41bf62a/0000000000000000:1290: protocol id = ISAKMP:
ike 0:13d44c5be41bf62a/0000000000000000:1290: trans_id = KEY_IKE.
ike 0:13d44c5be41bf62a/0000000000000000:1290: encapsulation = IKE/none
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=256
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_HASH_ALG, val=SHA.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_GROUP, val=MODP2048.
ike 0:13d44c5be41bf62a/0000000000000000:1290: ISAKMP SA lifetime=86400
ike 0:13d44c5be41bf62a/0000000000000000:1290: proposal id = 0:
ike 0:13d44c5be41bf62a/0000000000000000:1290: protocol id = ISAKMP:
ike 0:13d44c5be41bf62a/0000000000000000:1290: trans_id = KEY_IKE.
ike 0:13d44c5be41bf62a/0000000000000000:1290: encapsulation = IKE/none
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=256
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_HASH_ALG, val=SHA.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:13d44c5be41bf62a/0000000000000000:1290: type=OAKLEY_GROUP, val=MODP1536.
ike 0:13d44c5be41bf62a/0000000000000000:1290: ISAKMP SA lifetime=86400
ike 0:13d44c5be41bf62a/0000000000000000:1290: negotiation failure
ike Negotiate ISAKMP SA Error: ike 0:13d44c5be41bf62a/0000000000000000:1290: no SA proposal chosen
Created on 04-25-2024 07:24 AM Edited on 04-25-2024 07:29 AM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @hugo-spie ,
It seems interesting. Both site IPs look different.
HUB: ike 0: comes 2.2.2.5:500->77.77.77.254:500,
Spoke: ike 0: comes 2.2.2.25:500->99.99.99.254:500,ifindex=4,vrf=0
If you get a trial license from Fortinet, no need to use lower encryption. What I said is valid for an eval license.
Can you start over and follow this document for the ipsec configuration?
P.S
I found one video about ipsec configuration on two FortiGates. You can also follow this video.
https://www.youtube.com/watch?v=MHfjI13WiNI&ab_channel=ToThePointFortinet
If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it
easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It works with the good IP address, thanks. I will review my IPs and change the architecture.
Announcements
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
Related Posts
- [Help] SD-WAN with BGP on Loopback... 117 Views
- IP-Pool-Nat one to one not working 448 Views
- DHCP on Android Native VPN (L2TP/IPSec... 276 Views
- How to enable DHCP for dialup... 529 Views
- Some SDWAN(BGP) routes discovered on wan... 316 Views
Labels
-
FortiGate
8,464 -
FortiClient
1,712 -
5.2
801 -
FortiManager
711 -
5.4
639 -
FortiAnalyzer
547 -
FortiAP
457 -
FortiSwitch
456 -
6.0
416 -
FortiClient EMS
407 -
5.6
362 -
FortiMail
308 -
6.2
251 -
FortiAuthenticator v5.5
234 -
SSL-VPN
219 -
FortiWeb
199 -
5.0
196 -
IPsec
185 -
FortiNAC
176 -
FortiGuard
136 -
6.4
128 -
SD-WAN
110 -
FortiGateCloud
100 -
FortiSIEM
97 -
FortiCloud Products
96 -
FortiToken
89 -
FortiAuthenticator
84 -
Customer Service
78 -
Wireless Controller
75 -
Firewall policy
70 -
4.0MR3
64 -
FortiProxy
59 -
FortiADC
53 -
Fortivoice
52 -
High Availability
52 -
FortiEDR
50 -
vlan
47 -
ZTNA
46 -
FortiExtender
44 -
FortiSandbox
43 -
FortiDNS
42 -
DNS
40 -
Routing
39 -
BGP
38 -
LDAP
38 -
FortiGate v5.4
35 -
FortiSwitch v6.4
34 -
SAML
34 -
Certificate
33 -
Authentication
31 -
SSO
31 -
Interface
31 -
NAT
30 -
RADIUS
29 -
FortiConnect
27 -
FortiLink
26 -
FortiWAN
25 -
FortiConverter
25 -
VDOM
25 -
Application control
25 -
FortiGate v5.2
24 -
Logging
24 -
Web profile
23 -
FortiPAM
22 -
Virtual IP
22 -
Fortigate Cloud
20 -
FortiPortal
19 -
FortiSwitch v6.2
18 -
FortiMonitor
18 -
SSL SSH inspection
18 -
Traffic shaping
17 -
FortiDDoS
15 -
OSPF
15 -
WAN optimization
15 -
FortiGate v5.0
14 -
System settings
14 -
IP address management - IPAM
14 -
FortiSOAR
13 -
SSID
13 -
Static route
13 -
FortiCASB
12 -
snmp
12 -
Automation
12 -
Admin
12 -
Web application firewall profile
12 -
FortiManager v5.0
11 -
FortiManager v4.0
10 -
FortiRecorder
10 -
IPS signature
10 -
4.0MR2
9 -
FortiGate v4.0 MR3
9 -
FortiWeb v5.0
9 -
FortiBridge
9 -
Traffic shaping policy
9 -
FortiAP profile
9 -
Proxy policy
9 -
RMA Information and Announcements
8 -
Security profile
8 -
Port policy
8 -
4.0
7 -
FortiDeceptor
7 -
FortiAnalyzer v5.0
7 -
FortiCache
7 -
Fabric connector
7 -
Intrusion prevention
7 -
Explicit proxy
6 -
DNS filter
6 -
trunk
6 -
Packet capture
6 -
Antivirus profile
6 -
Traffic shaping profile
6 -
FortiToken Cloud
5 -
FortiTester
5 -
Users
5 -
Email filter profile
5 -
Web rating
5 -
Fortinet Engage Partner Program
5 -
3.6
4 -
FortiCarrier
4 -
FortiScan
4 -
FortiDirector
4 -
Internet service database
4 -
Application signature
4 -
DLP sensor
4 -
Netflow
4 -
Replacement messages
4 -
FortiDB
3 -
FortiHypervisor
3 -
API
3 -
FortiNDR
3 -
NAC policy
3 -
DLP Dictionary
3 -
DLP profile
3 -
DoS policy
3 -
Service
3 -
VoIP profile
3 -
Multicast routing
3 -
Cloud Management Security
3 -
FortiInsight
2 -
FortiAI
2 -
Kerberos
2 -
Authentication rule and scheme
2 -
Protocol option
2 -
TACACS
2 -
Schedule
2 -
SDN connector
2 -
Zone
2 -
4.0MR1
1 -
FortiManager-VM
1 -
FortiCWP
1 -
Subscription Renewal Policy
1 -
Video Filter
1 -
Multicast policy
1 -
Vulnerability Management
1
Top Kudoed Authors
| User | Count |
|---|---|
| 1660 | |
| 1077 | |
| 752 | |
| 443 | |
| 220 |
Broad. Integrated. Automated.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Security Research
Company
News & Articles
Copyright 2024 Fortinet, Inc. All Rights Reserved.