Hello,
In our company we have Fortigate 60D (v5.4.1) and I'm trying to setup the VPN with Cisco router. Cisco router is owned by other company and I do not have access to it. Phase 1 seems to work as expected ([...] - text cut for better visibility):
ike 0:phase-1-int:193473: negotiation result
ike 0:phase-1-int:193473: proposal id = 1:
ike 0:phase-1-int:193473: protocol id = ISAKMP:
ike 0:phase-1-int:193473: trans_id = KEY_IKE.
ike 0:phase-1-int:193473: encapsulation = IKE/none
ike 0:phase-1-int:193473: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=256
ike 0:phase-1-int:193473: type=OAKLEY_HASH_ALG, val=SHA2_512.
ike 0:phase-1-int:193473: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:phase-1-int:193473: type=OAKLEY_GROUP, val=ECP384.
ike 0:phase-1-int:193473: ISAKMP SA lifetime=28800
[...]
ike 0:phase-1-int:193473: VID CISCO-UNITY [...]
ike 0:phase-1-int:193473: peer supports UNITY
[...]
ike 0:phase-1-int:193473: DPD negotiated
ike 0:phase-1-int:193473: NAT not detected
ike 0:phase-1-int:193473: PSK authentication succeeded
ike 0:phase-1-int:193473: authentication OK
ike 0:phase-1-int:193473: established IKE SA [...]
But then I get the error as follows
ike 0:phase-1-int:193473: notify msg received: NO-PROPOSAL-CHOSEN
ike 0:phase-1-int:193473:phase-2-int:4954165: IPsec SPI d888eef3 match
ike 0:phase-1-int:193473:phase-2-int:4954165: delete phase2 SPI d888eef
I've asked the Cisco admin for config details and after comparison we have
Phase_1
the same Diffie-Hellman group the same proposal (aes256 - sha512) the same keylife (in seconds) Phase_2
The same Diffie-Hellman group ("dhgrp" parameter on Fortigate and "pfs" parameter on Cisco)
The same keylife (in kilobytes)
Proposals are:
Fortigate
set proposal aes256-sha512Cisco
set transform-set esp-aes_256_esp-sha512-hmacCan anyone tell me what could be wrong?
crypto ipsec transform-set esp-aes_256_esp-sha512-hmac esp-aes 256 esp-sha512-hmac
I'm not network specialist and I don't know even what to ask the mentioned Cisco admin.
Any help appreciated.
Best regards
Alex
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi Kadkwai
I've solved the problem after a lot of troubleshooting together with very skilled friend of mine.
I had to solve 2 issues:
1 - We had to NAT the traffic before it went into the tunnel (office lan -> NAT -> VPN tunnel)
2 - Than we received information that on the Cisco side the phase2 interface is configured to match specified IP addresses that are on the access list only (we specified the addresses before so we knew them all)
match address ac-list
My final configs are as follows Phase1
edit "vpn-p1"
set interface "wan1"
set keylife 28800
set proposal aes256-sha512
set dhgrp 20
set mesh-selector-type subnet <- this allows to provide several addresses "remote-networks-on-ac-list", see phase2 below
set remote-gw [1.2.3.4]
set psksecret ENC secret
next
Phase 2
edit "vpn-p2"
set phase1name "vpn-p1"
set proposal aes256-sha512
set dhgrp 20
set auto-negotiate enable
set keylife-type kbs
set src-addr-type name <- we need that to NAT our traffic
set dst-addr-type name <- we need that to mach the IP put on cisco access list
set keylifekbs 512000
set src-name "our-nat-ip" <- we need that to NAT our traffic
set dst-name "remote-networks-on-ac-list" <- we need that to mach the IP put on cisco access list
next
src-name and dst-name you can define in
config firewall address
e.g.
edit "our-nat-ip"
set subnet 3.4.5.6 255.255.255.255
next
edit "network-1"
set subnet 192.168.1.0 255.255.255.0
next
edit "network-2"
set subnet 192.168.2.0 255.255.255.0
next
and
config firewall addrgrp
e.g.
edit "remote-networks-on-ac-list"
set member "network-1" "network-2"
set allow-routing enable
next
Hope this helps!
BR
Alex
Hey Xander,
Thank you so much for detailed step-by-step explanation. Had an identical scenario and your explanation saved my day !!!
Regards,
Ajay Kumar K
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1502 | |
1011 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.