Greetings
Im configuring IPsec VPN for our office, im fairly new to forti configurations but i`v manged to set it up for our remote office, using forti 30d v5, but now im trying to configure the same on forti 200a but im unable to connect with the forticlient
i ran ike -1 debug and got the following output
ike 0: comes 197.231.195.152:500->172.17.x.x:500,ifindex=2... ike 0: IKEv1 exchange=Aggressive id=96e9ec0aecd61e97/0000000000000000 len=508 ike 0: no IKEv1 phase1 configuration matching 197.231.195.152:500->172.17.x.x 2 ike 0: comes 197.231.195.152:500->172.17.x.x:500,ifindex=2.... ike 0: IKEv1 exchange=Aggressive id=96e9ec0aecd61e97/0000000000000000 len=508 ike 0: no IKEv1 phase1 configuration matching 197.231.195.152:500->172.17.x.x 12
i have re-checked my configs several times and now im stuck, don`t know what to do next
please have a look at my topology (attaced) and configurations below
config vpn ipsec phase1-interface edit "My_VPN" set type dynamic set interface "wan2" set nattraversal disable set dhgrp 2 set proposal 3des-sha1 aes256-md5 aes192-sha1 set peertype one set xauthtype auto set mode aggressive set mode-cfg enable set peerid "vpn_client" set authusrgrp "ipsec_group" set ipv4-start-ip 172.17.7.101 set ipv4-end-ip 172.17.7.110 set ipv4-netmask 255.255.255.0 set psksecret ENC AABa/EsOB5k3Z1oE3SzT1harGW7GH3dmlPyXSqcqChvAUKBRwQ7ToM el08F0To4VR/vtO+F5R6TRnRNA0/BFSMyQdTNlDve8GQ4l0EtRhg8irxGB next end
config vpn ipsec phase2-interface edit "My_VPNp2" set encapsulation transport-mode set keylife-type both set pfs disable set phase1name "My_VPN" set proposal 3des-sha1 aes256-md5 aes192-sha1 set replay disable set keylifekbs 250000 set keylifeseconds 3600 next end
config firewall policy edit 19 set srcintf "My_VPN" set dstintf "internal" set srcaddr "ipsec_network" set dstaddr "Access_network" set action accept set schedule "always" set service "ANY" set logtraffic enable next end
What am i missing or doing wrong here!?
Please assist
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
possible reason:
'ifindex=2 in the ike debug' is where the ike packet are recieved from vpn dailoer. check if wan2 index is 2.
diag netlink interface list
you will see index=x for wan2 in the output.
Thanks for the reply
This is what im getting
if=wan2 family=00 type=1 index=2 mtu=1500 link=0 master=0 ref=220 state=start present flags=up broadcast run multicast
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1641 | |
1069 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.