Site-to-Site VPN not Working on FortiGate to ASA 5505

[DTLANetwork]

I'm trying to configure IPsec VPN on a Fortigate 80C, and on a Cisco ASA 5505 firewall. Fortigate 80C is running v4.0, build0646, and Cisco ASA 5505 is running 8.2(5), with ASDM 7.12.

I configured Site-to-Site on ASA and assigned a peer IP address of the FortiGate unit. I assigned a pre-shared key as well. ASA and FortiGate, both have matching pre-shared keys and identical phase 1 and phase 2 settings.

When I log into FortiGate using web interface, I go to Log & Report and click on Event Log. For Action I see negotiate with a message saying IPsec phase 1 error, and Error Reason no matching gateway for new request. It has ID 37124.

ASA can ping outside WAN IP 172.16.1.6, ASA can also ping IP 192.168.131.77 located inside its LAN network.

FortiGate can ping outside ASA IP 172.16.1.3, and it's internal LAN of IP 192.168.161.7.

My goal is to be able to ping from FortiGate internal IP 192.168.161.7 to ASA's internal IP 192.168.131.77.

Any help is greatly appreciated. I'm willing to post ASA running config, or anything requested to help make VPN work. Thank you for your time.

[Bubu]

Hi,

What type of configuration did you do Routed based or policy based? Did you create the roads? We need a route on the FortiGate: - Destination: 192.168.131.77/32 - Device: Your VPN interface - Gateway: 0.0.0.0/0.0.0.0.0

You also need a route on the ASA normally: - Destination: 192.168.161.7 - Device: Your VPN interface - Gateway: 0.0.0.0/0.0.0.0.0

You also need to create ipv4 policies to allow communication.

But depending on the error mentioned, it would seem that you have a problem with the IPs assigned on Phase 1.

Your FortiGate must have the following configuration on P1:

- IP address: 172.16.1.3

- Outgoing interface: WAN1

[DirkDuesentrieb]

I'm not so experienced in this ancient FortiOS but there should be a way to do ike debugging.

My guess is a missing policy for the tunneld traffic.

[Bubu]

Hi,

What type of configuration did you do Routed based or policy based? Did you create the roads? We need a route on the FortiGate: - Destination: 192.168.131.77/32 - Device: Your VPN interface - Gateway: 0.0.0.0/0.0.0.0.0

You also need a route on the ASA normally: - Destination: 192.168.161.7 - Device: Your VPN interface - Gateway: 0.0.0.0/0.0.0.0.0

You also need to create ipv4 policies to allow communication.

But depending on the error mentioned, it would seem that you have a problem with the IPs assigned on Phase 1.

Your FortiGate must have the following configuration on P1 (see picture).

[DTLANetwork]

@Bubu, I created routed and policy based configuration on FortiGate firewall. I attached pic.

I created a route on ASA firewall.

FortiGate firewall already has P1 with IP settings you mention.

I did notice error message IPsec phase 1 error is no longer appearing on FortGate. After making suggested changes, internal LAN's cannot ping each other yet..

[DTLANetwork]

I have updated info.

1. When I run "show isakmp sa" I receive "MM_ACTIVE." According to this output, I do have connectivity between two VPN endpoints. Phase 1 does come up.

2. When I run command show ipsec sa, I receive message “There are no ipsec sas.” Not good, this means Phase 2 tunnel configuration is down. How can it be down, if Phase 1 and Phase 2, have identical settings.

3. If I run tracert command from fortigate internal LAN pc, I notice if I ping fortigate WAN IP 172.16.1.6 I receive error code. This is telling me that no packets are leaving 192.168.161.1 interface.

4. If I run show crypto ipsec sa I receive this output "Automate NAT Detections Status: Remote end is NOT behind a NAT device This end is NOT behind a NAT device." My guess its complaining about ASA’s internal LAN? Nat is enabled on both Fortigate and Cisco!

[bendsley · Accepted solution]

Do you have a policy allow IPsec traffic into/out of the Fortigate?

[DTLANetwork]

The only policy I have configured are two policies consisting of source to remote and source to local. I'll attach pic to show you.

I was trying to configure policy to allow IPsec traffic into & out, but I'm having trouble creating new policy. It's asking for VPN Tunnel name, and when I enter a name it doesn't accept it.

Any suggestions how to to create IPsec traffic policy?

FortiGate unit is running OS V5.4.3. Thanks for your time.

[DTLANetwork]

In addition, I have two laptops pinging continuously. When I putty into FortiGate CLI, I see debug activity. It's saying authentication ok. I attach screen shot.

[ede_pfau]

Your route stating that 192.168.131.0/24 is on wan1 is wrong - it's behind the VPN tunnel. Change it to the VPN interface.