IPsec VPN tunnel down

[rbrahmi]

Hello,

I am trying to set up a VPN tunnel between a fortigate and palo alto firewall on the remote site, the fortigate is connected behind a juniper which is used to net the private address on the exterior interface of the fortigate and then we have a peplik which overcomes the public addresses with port redirects All VPN tunnels are connected except one tunnel Below are the logs generated by fortigate when I debug

ike 0:BKAM-DC:784401: out C2FE6E0C9FC42BEA00000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:BKAM-DC:784401: sent IKE msg (P1_RETRANSMIT): 192.168.10.2:500->105.73.83.17:500, len=288, id=c2fe6e0c9fc42bea/0000000000000000 ike 0:BKAM-DC:784401: negotiation timeout, deleting ike 0:BKAM-DC: connection expiring due to phase1 down ike 0:BKAM-DC: deleting ike 0:BKAM-DC: deleted ike 0:BKAM-DC: schedule auto-negotiate ike 0:BKAM-DC:784403: initiator: main mode is sending 1st message... ike 0:BKAM-DC:784403: cookie d03c7f08585f989f/0000000000000000 ike 0:BKAM-DC:784403: out D03C7F08585F989F00000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:BKAM-DC:784403: sent IKE msg (ident_i1send): 192.168.10.2:500->105.73.83.17:500, len=288, id=d03c7f08585f989f/0000000000000000 ike 0:BKAM-DC:784403: out D03C7F08585F989F00000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:BKAM-DC:784403: sent IKE msg (P1_RETRANSMIT): 192.168.10.2:500->105.73.83.17:500, len=288, id=d03c7f08585f989f/0000000000000000 ike shrank heap by 159744 bytes ike 0:BKAM-DC:784403: out D03C7F08585F989F00000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:BKAM-DC:784403: sent IKE msg (P1_RETRANSMIT): 192.168.10.2:500->105.73.83.17:500, len=288, id=d03c7f08585f989f/0000000000000000 ike 0:BKAM-DC:784403: out D03C7F08585F989F00000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:BKAM-DC:784403: sent IKE msg (P1_RETRANSMIT): 192.168.10.2:500->105.73.83.17:500, len=288, id=d03c7f08585f989f/0000000000000000 ike 0:BKAM-DC:784403: negotiation timeout, deleting ike 0:BKAM-DC: connection expiring due to phase1 down ike 0:BKAM-DC: deleting ike 0:BKAM-DC: deleted ike 0:BKAM-DC: schedule auto-negotiate ike 0:BKAM-DC:784405: initiator: main mode is sending 1st message... ike 0:BKAM-DC:784405: cookie 8001bc2bad1fee27/0000000000000000 ike 0:BKAM-DC:784405: out 8001BC2BAD1FEE2700000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:BKAM-DC:784405: sent IKE msg (ident_i1send): 192.168.10.2:500->105.73.83.17:500, len=288, id=8001bc2bad1fee27/0000000000000000 ike 0:BKAM-DC:784405: out 8001BC2BAD1FEE2700000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:BKAM-DC:784405: sent IKE msg (P1_RETRANSMIT): 192.168.10.2:500->105.73.83.17:500, len=288, id=8001bc2bad1fee27/0000000000000000 diag2020-10-23 12:05:38.934056 ike shrank heap by 159744 bytes

Any help please

Ragrds

[mauromosc]

Hi, Radouane,

Stupid question, but I have to ask you: did you enable NAT-T? Is this Juniper a router or a firewall? Does it have a rule allowing this traffic or is it NATing it? 

From the logs you can see that there is no response from the other peer, it would interesting to you debug the Palo Alto to see if it receives any thing from your FortiGate.

Good luck,

Mauro.

[rbrahmi]

Hi,

Can you tell me why this is a stupid question please?

Isn't this a forum for discussing issues like mine ?

If you think this is a stupid question, don't answer please

Regards

[mauromosc]

Hi, Radouane,

I'm sorry, I wasn't clear about my text. My question was stupid. :)  Also count to 10 before texting and read again:

Stupid question, but I have to ask you

And your concern is completely valid and add value to the discussions here.

Regards,

Mauro Mosczynski

[rbrahmi]

Hi Mauro, 

I'm sorry too, I did not understand very well The issue has been resolved, it was coming from the remote site on the palo alto firewall now the tunnel is up thank you very much for your precious help

Regards

[mendocino]

Hello, how are you? You were able to solve the problem, since I have a similar problem