Negotiate SA Error

[#1]

New to Fortinet and VPN... I setup my Fortigate-60 similar to the example from the documentation: " Dialup-Client IPSEC VPN Example" When I try to connect I get the following error in my Forticlient log: status=negotiate_error msg=" Negotiate SA Error: protocol_id=1, notify_msg=18 (INVALID_ID_INFORMATION), ispi_size=0 " . When attempting to connect I' m behind a Linksys router with no firewall. Anyone know why I' m getting this or is their some better documentation I can follow to figure out this message? Thank' s

[#2]

I have the same issue on a FG50A with MR8 359 after updating from MR6. A VPN connection working beforehand, does not work anymore :-( I also get error 18 and I have spent at least 2 hours on testing diverse modes and settings without success. You could check your Preshared Key for non allowed characters and try agressive as well as main mode. See if you have IDs configured and try it without ID on the fortigate in order to exclude any restrictions from that side. I had no luck with that. I get quick mode message 1 OK from the client while in the log file of the fortigate quick mode message 1 is listed with error. If I use the option wildcard selector instead of use policy selectors under the advance tab of phase 2 for the quick mode settings, the negotiation works fine but I cannot ping the remote network or the fortigate. I have double checked the remote network and IP settings, they are fine according to the guide. Any ideas from the pros? Could someone get me a hint to what these quick mode messages are? Alex

[UkWizard]

You get this when the forticlients settings dont match up to the firewall settings. Especially the SOURCE/DEST networks specified in the VPN rule (or if you use multiple vpn rules). If it goes wrong after an upgrade, check the release notes, as some upgrades change the " peerid" vpn settings. Generally if you have an allocated external subnet, put that in the source and leave dest as external_all. Then make sure on the forticlient that the remote networks setting matches the SOURCE subnet EXACTLY.

[#4]

Hello, thx again for your help but I still don' t get it to work. The VPN worked fine before the upgrade MR6 292 to MR8 359. I checked the peer id in phase 1, it is set to accept all. No ID in the client. The algorithm settings are equal in client and machine. I tried aggressive and main mode. Same Problem. Assume internal net behind the FG is 192.168.80.0/255.255.255.0. Internal IP of FG is 192.168.80.1 Firewall Policy 192.168.80.0 Source to all Dest (also tried 192.168.5.0/255.255.255.0 for Dest the subnet in which the Client PC is connected) Policy is on top. VPN Source is 192.168.80.0/255.255.255.0 (also tried with 255.255.255.255) but I also tried 192.168.80.106/255.255.255.0 (and 255) changing remote network in client accordingly of course. Client VirtualIP Setting is 192.168.80.107/255.255.255.0 (also tried 106) and remote network is 192.168.80.0/255.255.255.0 (192.168.80.106/255.255.255.0 and 255 did not work either) The preshared key is correct and doublechecked also tested with abc, so no spelling errors. Although the client is behind a router, giving privileged internet access without firewall produced the same mistake. Ports 500 and 4500 opened (compare log excerpt). Inbound and Outbound NAT checked and unchecked, same error. I get a handshake if I say use wildcard selectors instead of policy selectors but in that case I cannot ping the PCs with 192.168.80.x behind the FG. Test Log from Client: In run_timer_list, jiffies=00000001, skipped = 0 tvecs[1]->bits is 3, tvecs->index is 0 Comes (extIP of FG):4500->192.168.70.11:4500,ifindex=0, .... Exchange Mode = 5, Message id = 0x48CCAC11, Len = 68 ####### ISAKMP INFO ########## Received Payloads= HASH Notif ######### Receive Information Payload(Protected)######### protocol_id=1, notify_msg=18 (INVALID_ID_INFORMATION), ispi_size=0 Negotiate SA Error: protocol_id=1, notify_msg=18 (INVALID_ID_INFORMATION), ispi_size=0 [43] FG log: 3 2005-03-21 10:55:31 log_id=0101023004 type=event subtype=ipsec pri=notice vd=root loc_ip=(extIP of FG) loc_port=4500 rem_ip=(ext Router IP of FG Client PC) rem_port=500 out_if=ppp0 vpn_tunnel=hugclient action=negotiate init=remote mode=quick stage=1 dir=inbound status=failure msg=" Responder: parsed (ext Router IP of FG Client PC) quick mode message #1 (ERROR)" 4 main mode message #3 (DONE)" 5 main mode message #2 (OK)" 6 main mode message #1 (OK)" Thx for reading all this, I have no ideas left, honestly. Alex

[UkWizard]

Try with " use wildcard selectors" and aggressive mode. If it still doesnt work, use a seperate IP subnet for the vpn clients. Then set this subnet for the destination

[#6]

The Wild Card selectors did the trick for me!. I also had to set a static address on my client. I tried setting up a DHCP Relay but no success yet. Anyone get this to work? Thanks.

[UkWizard]

DHCP does work, you will need the following though; Most recent forticlient Fairy recent firmware the fortinet MUST be the default route of the DHCP server. DHCP relay enabled on the EXTERNAL interface DHCP enabled on the VPN settings.

[#8]

I' m running 2.8 Firmware with the latest Forticlient. I have an internal DHCP server on a 192.168.1.x network. My client is on a 10.0.0.x network. DHCP relay is setup on the external interface pointing to my 192.168.1.x internal DHCP server. Also, the DHCP server is set to point to the fortinet as it' s gateway. Anything else I' m missing?

[#9]

Don' t forget that you can' t use the internal DHCP server on the Fortinet but have to use one on the internal network(sucks). While we' re discussing this though. If you use DHCP over ipsec, does the clients net still have to be in a separate net from the internal one? Or will you be able to use the same address scope as the clients on the inside?

[UkWizard]

yes the same, or different, works for either. Using the same internal one as the internal clients makes browsing/dns/resolving much smoother as well. Prevents the Active Directory security problems as well.