Issues with Fortigate to ASA site to site IPSEC tunnel

[jimstumbo]

We are trying to create an IPSEC tunnel and phase 1 is working just fine.  After phase 1 is negotiated, it does not proceed to phase 2 negotiation.  I have configured phase 2, so it should be negotiating it.  I do not have access to the ASA on the customer side, but they assure me that they have it configured on their end as well.

The last line in a debug is:

 no pending Quick-Mode negotiations

From what I have read, it almost sounds like there is no phase 2 configured?  But there clearly is and it is right there on the UI.  Any idea what this could be?  Anyone know of anything on the customer (ASA) side that might be causing this?

TIA

Jim

[emnoc]

Qs: are you using  quad 0s  ) aka 0.0.0.0/0:0  or did you do it right and define  src/dst-subnets

What the cfg ( FGT )

what the cfg ( ASA )

read this blog of mine on FGT-ASA, it was to a 9.1.x &  using ike iKEv1, principle still applies for  FGT<---2----> ASA

http://socpuppet.blogspot.com/2014/05/site-2-site-vpn-fortinet-fortigate-to.html

[jimstumbo]

I am using the actual subnets in the configuration of phase 2.  My side is a /24 and the other side is a single IP address (/32).  I will check out your blog.  I have around 60 vpn tunnels already, most to ASAs on the other side and I have never run into this problem before.  Everything is configured just like I do all my tunnels, which kind of leads me to believe that there would be something on the other side.  I am the initiator though.  So I would think that at least it would try phase 2 negotiation and just come back and say something about not being able to find a proposal to agree on...

thanks

[emnoc]

You still need to review  the settings. Many items keeps Ph2 down

PFS

proposals

proxy-id mismatches

etc..

[jimstumbo]

Here is what I have.  It is pretty much the same as the other 60 ipsec tunnels I have.  Different levels of security, and frankly I do not want to go this low, but do not have a choice with this customer. 

I have had problems in the past, but it is usually because there is some differences in the phase 2 proposals, so we just make sure they match and it works.  In this case, they match as far as I know (don't have access to the remote config), and it does not even seem to be trying to negotiate the phase 2.  Just gives the error "no pending Quick-Mode negotiations" at the point I would expect it to start the phase 2 negotiations.

config vpn ipsec phase1-interface edit "vpn-61" set interface "vl-61" set keylife 28800 set proposal aes256-sha1 set dhgrp 2 set remote-gw x.x.x.x set psksecret ENC dUmLYV0TmKRIvBJyZAPrOwe4BiIcBukA== next end

config vpn ipsec phase2-interface edit "vpn-61" set phase1name "vpn-61" set proposal aes128-sha1 set dst-addr-type ip set keylifeseconds 28800 set src-subnet y.y.y.y 255.255.255.0 set dst-start-ip z.z.z.z next end

[Jirka1]

Hi, we have about 12 site2site ipsec between FGT and ASA. Like emnoc say: it´s very important to keep all settings items like: PFS, proposals, keyliftime, etc.  Then everything works flawlessly.

[emnoc]

OP, you  will need to conduct some diagnostics on both ASA and FGT,no way can you  t-shot what's happen on the  remote without diagnostic

As side approach would be to enable all proposals  combination until you see one that matches  but again if the cisco ASA  crypto-acl is not finished, incorrect, not matching, etc... you will be battling air at this point.

;)

Ken