Negotiate SA Error: ike negotiation timeout

[vincenzo_pyx]

Hello,

I've a problem with only some clients (some users can connect to the tunnel without any problem). 

The VPN client is Fortigatevpn 7. 4.3 and the firmware of the Fortigate is the v7.6.3 build3510.

This is the trace of one of the connection that ends with the timeout:

ike V=root:0: comes xxx.xxx.xxx.xxx:4500->yyy.yyy.yyy.yyy:55008,ifindex=3,vrf=0,len=389....
ike V=root:0: IKEv2 exchange=SA_INIT id=a26c3f92f0df5a36/0000000000000000 len=385
ike 0: in A26C3F92F0DF5A3600000000000000002120220800000000000001812200006C02000034010100050300000C0100000C800E01000300000802000005030000080300000C0300000804000015000000080400001400000034020100050300000C0100000C800E01000300000802000005030000080300000C0300000804000015000000080400001428000068001400000D6B9152EBB35B01EA7298CF01F3127CF921F13B1855AA2DD180EC15DA2315F3601081A8BFA658707448BC16F20E1B3337FDB618FF0137B6AB68C13718A34889ADE62BF3728F840FEAC090A542E69C8FA8F2214EE2026060E3B5824EADA389562B000014F3EC39D2CC6635F93DC56A90466163AF2B0000144C53427B6D465D1B337BB755A37A7FEF2B000014B4F01CA951E9DA8D0BAFBBD34AD3044E29000014C1DC4350476B98A429B91781914CA43E2900001C000040044C8AF795C5D8F29FA928B919E59846D40E38ACBE2900001C000040058D6E1C37520B62E8DBEED4B4961D20F503611418000000090000F05000
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: responder received SA_INIT msg
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: VID forticlient connect license 4C53427B6D465D1B337BB755A37A7FEF
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: VID Fortinet Endpoint Control B4F01CA951E9DA8D0BAFBBD34AD3044E
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: VID Forticlient EAP Extension C1DC4350476B98A429B91781914CA43E
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: received notify type NAT_DETECTION_SOURCE_IP
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: received notify type NAT_DETECTION_DESTINATION_IP
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: received notify type VPN_NETWORK_ID
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: NETWORK ID : 0
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: incoming proposal:
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: proposal id = 1:
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: protocol = IKEv2:
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: encapsulation = IKEv2/none
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: type=ENCR, val=AES_CBC (key_len = 256)
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: type=INTEGR, val=AUTH_HMAC_SHA2_256_128
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: type=PRF, val=PRF_HMAC_SHA2_256
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: type=DH_GROUP, val=ECP384.
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: type=DH_GROUP, val=ECP521.
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: proposal id = 2:
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: protocol = IKEv2:
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: encapsulation = IKEv2/none
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: type=ENCR, val=AES_CBC (key_len = 256)
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: type=INTEGR, val=AUTH_HMAC_SHA2_256_128
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: type=PRF, val=PRF_HMAC_SHA2_256
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: type=DH_GROUP, val=ECP384.
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: type=DH_GROUP, val=ECP521.
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: matched proposal id 1
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: proposal id = 1:
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: protocol = IKEv2:
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: encapsulation = IKEv2/none
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: type=ENCR, val=AES_CBC (key_len = 256)
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: type=INTEGR, val=AUTH_HMAC_SHA2_256_128
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: type=PRF, val=PRF_HMAC_SHA2_256
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: type=DH_GROUP, val=ECP384.
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: lifetime=86400
ike V=root:0:a26c3f92f0df5a36/0000000000000000:733: SA proposal chosen, matched gateway guard3
ike V=root:0:guard3:guard3: created connection: 0x1d1b69d0 3 xxx.xxx.xxx.xxx->yyy.yyy.yyy.yyy:4500.
ike V=root:0:guard3:733: processing notify type NAT_DETECTION_SOURCE_IP
ike V=root:0:guard3:733: processing NAT-D payload
ike V=root:0:guard3:733: NAT detected: PEER
ike V=root:0:guard3:733: process NAT-D
ike V=root:0:guard3:733: processing notify type NAT_DETECTION_DESTINATION_IP
ike V=root:0:guard3:733: processing NAT-D payload
ike V=root:0:guard3:733: NAT detected: PEER
ike V=root:0:guard3:733: process NAT-D
ike V=root:0:guard3:733: FEC vendor ID received FEC but IP not set
ike 0:guard3:733: FCT EAP 2FA extension vendor ID received
ike V=root:0:guard3:733: responder preparing SA_INIT msg
ike V=root:0:guard3:733: generate DH public value request pending
ike V=root:0:guard3:733: responder preparing SA_INIT msg
ike V=root:0:guard3:733: compute DH shared secret request queued
ike V=root:0:guard3:733: responder preparing SA_INIT msg
ike V=root:0:guard3:733: create NAT-D hash local xxx.xxx.xxx.xxx/55008 remote yyy.yyy.yyyy.yyy/4500
ike V=root:0:guard3:733: sending CERTREQ payload (len=21)
ike V=root:0:guard3:733: certreq[0]: '712B5E612B0CA7ABD5D5B8C128D717F1435AA621'
ike 0:guard3:733: out A26C3F92F0DF5A36293076DA97E9F2F3212022200000000000000119220000300000002C010100040300000C0100000C800E01000300000802000005030000080300000C00000008040000142800006800140000A0A77C56E9A234F4040EA2BFB6FA3E6BCF6CE6B30E2047370A059EC9BD3067ED52FCFC13662C638B2669DC36CBF79F4F842D0C556CB7D48C9E023950EF8390B89C3AE409E9DB8659F3D98D46CA89B47EC9D477D2515690DFE9863F4026070A69290000147EA1079D75D1BAA3D6D81412FCE1238E2900001C00004004AB17048325D7DE42BB27B4B13CB4C35DF55F104B2600001C000040051246A23434CE8040CEA0ED03E4E623D9322F48FE0000001904712B5E612B0CA7ABD5D5B8C128D717F1435AA621
ike V=root:0:guard3:733: sent IKE msg (SA_INIT_RESPONSE): xxx.xxx.xxx.xxx:55008->yyy.yyy.yyy.yyy:4500, len=281, vrf=0, id=a26c3f92f0df5a36/293076da97e9f2f3, oif=3
ike 0:guard3:733: IKE SA a26c3f92f0df5a36/293076da97e9f2f3 SK_ei 32:F77C9338C83795D96607F4204B8BFFCA7D6B60C712DAB6EBE50C4E1033D0E25F
ike 0:guard3:733: IKE SA a26c3f92f0df5a36/293076da97e9f2f3 SK_er 32:DEBEE98E6FD5C751C26D711BBAF927794C7B22082D6B148F5542A8D4D2113635
ike 0:guard3:733: IKE SA a26c3f92f0df5a36/293076da97e9f2f3 SK_ai 32:5103DB0A8C1A84AE7BD459636E4A2F758049F3B59657D2684ACA6A85A1D8146B
ike 0:guard3:733: IKE SA a26c3f92f0df5a36/293076da97e9f2f3 SK_ar 32:F3006122BAB1E1685BFEF669E8B5BC5D4EFC7694D98EAFB310ACFAC70CD2DC60
ike V=root:0:guard3:733: negotiation timeout, deleting
ike V=root:guard3 Negotiate SA Error: ike negotiation timeout
ike V=root:0:guard3: connection expiring due to phase1 down
ike V=root:0:guard3: going to be deleted

this is the tunnel configuration:

set type dynamic
set interface "wan1"
set ike-version 2
set authmethod signature
set net-device disable
set mode-cfg enable
set ipv4-dns-server1 8.8.8.8
set proposal aes256-sha256
set negotiate-timeout 50
set dpd disable
set dhgrp 20 21
set eap enable
set eap-identity send-request
set wizard-type dialup-forticlient
set transport auto
set certificate "name.name.it"
set peer "smp_peer"
set ipv4-start-ip 9.5.6.7
set ipv4-end-ip 9.5.6.70
set ipv4-split-include "smp_split"
set save-password enable
set client-auto-negotiate enable
set client-keep-alive enable

I don't understand why only some clients can't connect....

thanks

[kaman]

Hi vincenzo_pyx,

Can see that (SA_INIT_RESPONSE) is sent by FortiGate however, there is no reply from the FortiClient followed by negotiation timeout.

Please refer to the document below and enable debug log in FortiClient and check what error you are getting and share.

https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-enable-debug-log-in-FortiClient/t...

Regards!

[vincenzo_pyx]

Hello,

the log only contains this:

23/07/2025 18:31:22 debug ipsecvpn AuthDaemon. Message in pipe
23/07/2025 18:31:22 debug ipsecvpn AuthDaemon. CSP_AND_CERTNAME
23/07/2025 18:31:22 debug ipsecvpn {"source":1,"thumbprint":"C0362A7BBD748900194B1859AE4DD7BE3FC39733"}
23/07/2025 18:31:22 debug ipsecvpn AuthDaemon. Certificate returned
23/07/2025 18:31:22 debug ipsecvpn AuthDaemon. Message in pipe
23/07/2025 18:31:22 debug ipsecvpn AuthDaemon. Message in pipe UNSIGNED_HASH
23/07/2025 18:31:22 debug ipsecvpn AuthDaemon. Signed hash.
23/07/2025 18:31:40 debug ipsecvpn AuthDaemon. Message in pipe
23/07/2025 18:31:40 debug ipsecvpn AuthDaemon. Got Quit message.
23/07/2025 18:31:40 debug ipsecvpn authentication finished

Thanks in advance,

Vincenzo