Site to site VPN one site DDNS is Down

[galal2010]

Dears

I configured stie to site VPN between 2 Fortigate firewalls and the tunnel is down

I have 2 Fortigate sites

Site 1 : FGT60 use DDNS

i have 3 WAN interfaces (Wan 1 , Wan 2 , Wan 3) connected to internet through ADSL router so they have private IP and router do NAT for real IPs these interfaces are connected to SDWAN zone with IP (0.0.0.0/0.0.0.0)

VPN configuration on this site:

remote gateway: static IP address

IP address: (Public IP of remote site)

interface: WAN 1 (has private IP)

Site 2 : FGT30 has static Public IP

VPN configuration on this site:

remote gateway: Dyanmic DNS

IP address: (FQDN)

interface: WAN interface with Public IP

this is the debug of on site has DDNS

initiator: aggressive mode is sending 1st message...
ike 0:Saudi-Egy-VPN:138: cookie 604c40131d555a58/0000000000000000
ike 0:Saudi-Egy-VPN:138: out 604C40131D555A580000000000000000011004000000000000000290040000B40000000100000001000000A8010100040300002801010000800B0001000C00040001518080010007800E00808003000180020004800400050300002802010000800B0001000C00040001518080010007800E01008003000180020004800400050300002803010000800B0001000C00040001518080010007800E00808003000180020002800400050000002804010000800B0001000C00040001518080010007800E01008003000180020002800400050A0000C4EFC475BE489751F43CF098060BFD9B9742A14F7E2097FE12C5922E0BA4ECBDB3A69C808F584F9C6A52685035CDAB8F9C712891AD3A8FDDD494010D084B0B66197E57E40DAE58D0D98435EB7D89B12AE39FB77440B87F4BE853AB7FB988713EB608208B6FB2599BEF4959AC347CBC225E38CC86C517717B4FE5E091A1E22172B3E0F9CF33D404D7B1DB7453A1A7C067EC38EA357B64517F39A5EBD34A21A79473F75D0ADA2607CE74A7604B78E74520CFB524365E6874974B6268E9BA7885265D0500002429C0488FE69925D92769D3AD61A52C51D0F13564D06C94C939678D5FE978ED4C0D00000C01000000C0A85A050D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000
ike 0:Saudi-Egy-VPN:138: sent IKE msg (agg_i1send): 192.168.90.5:500->41.178.109.139:500, len=656, vrf=0, id=604c40131d555a58/0000000000000000
diagnose debug enableike 0:Saudi-Egy-VPN:138: out 604C40131D555A580000000000000000011004000000000000000290040000B40000000100000001000000A8010100040300002801010000800B0001000C00040001518080010007800E00808003000180020004800400050300002802010000800B0001000C00040001518080010007800E01008003000180020004800400050300002803010000800B0001000C00040001518080010007800E00808003000180020002800400050000002804010000800B0001000C00040001518080010007800E01008003000180020002800400050A0000C4EFC475BE489751F43CF098060BFD9B9742A14F7E2097FE12C5922E0BA4ECBDB3A69C808F584F9C6A52685035CDAB8F9C712891AD3A8FDDD494010D084B0B66197E57E40DAE58D0D98435EB7D89B12AE39FB77440B87F4BE853AB7FB988713EB608208B6FB2599BEF4959AC347CBC225E38CC86C517717B4FE5E091A1E22172B3E0F9CF33D404D7B1DB7453A1A7C067EC38EA357B64517F39A5EBD34A21A79473F75D0ADA2607CE74A7604B78E74520CFB524365E6874974B6268E9BA7885265D0500002429C0488FE69925D92769D3AD61A52C51D0F13564D06C94C939678D5FE978ED4C0D00000C01000000C0A85A050D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000

[Faiza_Emam_Delhi]

Hello,

The debug output you provided shows that the initiator (Site 1) is using aggressive mode and sending the first message to the responder (Site 2). The debug output also shows that the responder is receiving the message and responding back with an IKE message.

However, the debug output does not show any error messages related to the VPN tunnel being down or any issues with the VPN configuration. This suggests that the issue may not be related to the VPN configuration.

Since Site 1 is using DDNS, it's possible that the issue is related to the DDNS service being down or not resolving correctly. You may want to check the DDNS settings on Site 1 and ensure that the DDNS service is resolving to the correct IP address.

Another possibility is that the firewall policies on Site 1 are not configured correctly to allow VPN traffic to pass through. You may want to check the firewall policies on Site 1 and ensure that the source and destination addresses and ports are configured correctly.

If you're still having issues after checking these settings, you may need to provide more information about the network topology and the configuration settings on both FortiGate devices to help diagnose the issue.

I hope this helps! Let me know if you have any further questions.

[galal2010]

get vpn ipsec tunnel details

gateway
name: 'Egy-Saudi-VPN'
local-gateway: 41.178.109.139:0 (static)
remote-gateway: 176.44.67.135:0 (static)
dpd-link: off
mode: ike-v1
interface: 'wan1' (5) vrf:0
rx packets: 0 bytes: 0 errors: 0
tx packets: 0 bytes: 0 errors: 1

from this command i see that no encapsulation of IPsec packet on  port 4500

could be a problem in ADSL router

[kvimaladevi]

Hi galal2010,

Please help us with the complete ike debug logs to check if there are any error messages or to check what has happened to the vpn connection request.

Regards,
Vimala

[parteeksharma]

Hi galal2010,
As per the logs output it seems only 1st message was captured, to check and verify the tunnel behavior we need compete ike debug logs, kindly share us below ike debug logs using below commands:

diagnose debug reset

diagnose vpn ike log-filter clear

diagnose vpn ike log-filter dst-addr4 x.x.x.x ------------where x.x.x.x is the remote gatewayIP

diagnose debug app ike -1

diagnose debug enable

After 1 minute, disable the logs by executing

diagnose debug disable

Putty2:

---------------------------

>>Simultaneously open an another session of putty, start the logging and run the below command

diagnose sniffer packet any "host b.b.b.b " 6 0 a

Where b.b.b.b is the remote gateway address.  After 1 minute, disable the logs by executing "ctrl+c"
Please share us logs to check and verify.

Regards,
Parteek