[Solved] Failing to connect VPN from Fortigate 30D to Azure

[erpmaestro]

Solution:

I simply didn't correctly set my public IP correctly in the Azure portal when defining my local network. I used the IP that I discovered in the appliance and totally neglected that there was another NAT router further up in my office building.

Problem:

Hello all,

I'm attempting to use my Fortigate to connect to the Azure VPN and followed the video instructions step by step. However, when I attempt to bring it up, I get no success. When I use the diag, I see the following messages

I believe the key line of error is the

[size="2"]ike 0:AzureVPN:5851: received notify type AUTHENTICATION_FAILED[/size]

If this is related to mistyping the shared key, I typed this in, clicked the copy key and pasted, copied manually and pasted it in, copied to notepad and pasted it in.

Please let me know if I'm not looking at the right place or if anyone needs more information to diagnose.

[size="2"]ike 0:AzureVPN: schedule auto-negotiate ike 0:AzureVPN: auto-negotiate connection ike 0:AzureVPN: created connection: 0x2d70000 5 xxx.xxx.xxx.xxxx->yyy.yyy.yyy.yyy:500. ike 0:AzureVPN:AzureVPN: chosen to populate IKE_SA traffic-selectors ike 0:AzureVPN: no suitable IKE_SA, queuing CHILD_SA request and initiating IKE_SA negotiation ike 0:AzureVPN:5851: out CDF6B92965C6F25C000000000000000021202208000000000000016C220000B40200002C010100040300000C0100000C800E01000300000802000002030000080300000200000008040000020200002C020100040300000C0100000C800E01000300000802000005030000080300000C00000008040000020200002C030100040300000C0100000C800E00800300000802000002030000080300000200000008040000020000002C040100040300000C0100000C800E00800300000802000005030000080300000C00000008040000022800008800020000195AAE81765370D4156AAEC8B61E0E1D76CF185B3463AD2CFC40C7845308B9442F64D1761B27AB4D7C0BD3F7D8F4EC34AC367534F7C5C79BEABE2D7D94AE687CA5937110754E437803A04F2ED0EBF542B08E7ACCBF736A731EE05ABC0074F73500961782D47734495F829C915AD083470A860279B43706CBA3944A7638E5889E00000014632C7B8E43D44EB18326181ED1CEB6A3 ike 0:AzureVPN:5851: sent IKE msg (SA_INIT): xxx.xxx.xxx.xxxx:500->yyy.yyy.yyy.yyy:500, len=364, id=cdf6b92965c6f25c/0000000000000000 ike 0: comes yyy.yyy.yyy.yyy:500->xxx.xxx.xxx.xxxx:500,ifindex=5.... ike 0: IKEv2 exchange=SA_INIT_RESPONSE id=cdf6b92965c6f25c/0aa00c68858ee14d len=809 ike 0: in CDF6B92965C6F25C0AA00C68858EE14D212022200000000000000329220000300000002C030100040300000C0100000C800E008003000008030000020300000802000002000000080400000228000088000200004A2289AF543817E581F01294B6728D5EF05ACFFA13D8202C59F22BF707C22B4BD4A9810F01563ADA96B04440AF6EBE9A66BC7CEB2C8944179750BC99E85776D81E77B09C98F3A7353D4EF57E12A145EAD26470356B6AC0BACB8E03C220A2E95B717309F2E8B8559426273EFD4EFC8FB4B7C0325683EC3363D99D5CFBC68BE7E129000034E5D47C3FC9EF1370676866D4582257B3BD7F2B0C9B33C33574B1EF1D1DA98BD0E4794E708E83C63704A5F1915108C6332900001C000040041A859575EF05EEAA767D6379767ACE6D433F8CAC2B00001C000040050DD8CF38D72208249D91A60A496072AAB2CBE5192B0000181E2B516905991C7D7C96FCBFB587E4610000000926000014FB1DE3CDF341B7EA16B7E5BE0855F120000001BD040EAC826040562797E52513FC2AE10A539559E4A4DDBCBD869C3F07ED40E31B08EFCEC4D188CD3B154A5C7522AA46BFA4089D39974EBDB4A360F7A01D6A47A267C92E2F19688B9B86616695EDC12C13001C6981BCF1C96EAD895D5A64FD2D2F0DAE81FFD401F0334C1AA1D9EE5B7BA9DE43BC027D570933FB88A95AEFC084FC1374416BB16332C2CF9259BB3B22CD37F1B14750AE537C8C6A036747E2B71E17B7344F302D256 3191EAF7735CABF5868D378240EC3EDF290CC1F5CC732CEB3D24E17E52DABD27E2F0F79319EFDFC1F520FBAC85552CF2D28F5AB9CA0B30A4E64FDE768AFCED5A9084283046792C29157087DBD45FB0928D4E1DF81567E7F2ABAFD62B6775D52E13C1ABE349DAE8B49594EF7C3843606466BD597912DE6175D66FC423B7771374C796DE6F887255921A5B2E62B0E07B8BA9AE9FFCA0F6E656263CA5068A78CF84BD7432DD58F965EB3A55E7C780DCE27F7BD877D5DF9E0A3F9EB4CB0E2EA9EFDB697783317E62854253D6D7783190EC919056E991B9E39980BF7CF4508BA2D04CE3A186E4F382711E0CC7BB2D75CE172ACCDF05D9A86D278298889986C89168330E61358521592983A3C8D2D2E1406E7AB3C1 ike 0:AzureVPN:5851: initiator received SA_INIT response ike 0:AzureVPN:5851: received notify type NAT_DETECTION_SOURCE_IP ike 0:AzureVPN:5851: ignoring unauthenticated notify payload (NAT_DETECTION_SOURCE_IP) ike 0:AzureVPN:5851: received notify type NAT_DETECTION_DESTINATION_IP ike 0:AzureVPN:5851: ignoring unauthenticated notify payload (NAT_DETECTION_DESTINATION_IP) ike 0:AzureVPN:5851: incoming proposal: ike 0:AzureVPN:5851: proposal id = 3: ike 0:AzureVPN:5851:   protocol = IKEv2: ike 0:AzureVPN:5851:      encapsulation = IKEv2/none ike 0:AzureVPN:5851:         type=ENCR, val=AES_CBC (key_len = 128) ike 0:AzureVPN:5851:         type=INTEGR, val=AUTH_HMAC_SHA_96 ike 0:AzureVPN:5851:         type=PRF, val=PRF_HMAC_SHA ike 0:AzureVPN:5851:         type=DH_GROUP, val=MODP1024. ike 0:AzureVPN:5851: matched proposal id 3 ike 0:AzureVPN:5851: proposal id = 3: ike 0:AzureVPN:5851:   protocol = IKEv2: ike 0:AzureVPN:5851:      encapsulation = IKEv2/none ike 0:AzureVPN:5851:         type=ENCR, val=AES_CBC (key_len = 128) ike 0:AzureVPN:5851:         type=INTEGR, val=AUTH_HMAC_SHA_96 ike 0:AzureVPN:5851:         type=PRF, val=PRF_HMAC_SHA ike 0:AzureVPN:5851:         type=DH_GROUP, val=MODP1024. ike 0:AzureVPN:5851: lifetime=56600 ike 0:AzureVPN:5851: IKE SA cdf6b92965c6f25c/0aa00c68858ee14d SK_ei 16:DC3A5F30A978AE4BEAABF54D14CB5E5E ike 0:AzureVPN:5851: IKE SA cdf6b92965c6f25c/0aa00c68858ee14d SK_er 16:15BC3779730136398F4D9ABD2925995C ike 0:AzureVPN:5851: IKE SA cdf6b92965c6f25c/0aa00c68858ee14d SK_ai 20:028F3AD894D1FB57F2D8606D15158C17A8B09CF7 ike 0:AzureVPN:5851: IKE SA cdf6b92965c6f25c/0aa00c68858ee14d SK_ar 20:F28CEED92DF487B02B1EF88FBB60EE4D18488FB3 ike 0:AzureVPN:5851: initiator preparing AUTH msg ike 0:AzureVPN:5851: sending INITIAL-CONTACT ike 0:AzureVPN:5851: enc 2900000C010000000A213E0C27000008000040002900001C02000000B617525FB24BD868437C6728CE673819637FA29121000008000040242C0000A40200002801030403DCB282730300000C0100000C800E0080030000080300000200000008050000000200002802030403DCB282730300000C0100000C800E0100030000080300000200000008050000000200002803030403DCB282730300000C0100000C800E0080030000080300000C00000008050000000000002804030403DCB282730300000C0100000C800E0100030000080300000C00000008050000002D00001801000000070000100000FFFFC0A80100C0A801FF0000001801000000070000100000FFFF0A0000000A0000FF03020103 ike 0:AzureVPN:5851: out CDF6B92965C6F25C0AA00C68858EE14D2E202308000000010000014C23000130DD21BDBEF9CA7ECB91423764623474F2DCC200E89418535B7BA55DA12ABCB65355C3A404E93ECAB6BE3A69D4BD4A975A8DB122D6500C6CA9F4B62D6BCC1384FA160450DF87F5F0436E4286E4BA43744B87EAC3C8E3C3ACFC3CF9F9F9CE68E3ECB500D7AB1739D17B2699A1B980E1672C3BB1741204F649E03BEE8E28ADC375D6081453A3845277E32EAC39710AF10B6878FE0BDBF7046B62EBBB97C17CCA88BE060B7EC452A912D0D5CF69E6DF7B9B1AFC1F66AAEA7D7ACD6CCD9A683974CE7D0D1FCB8671B139593F34A3A472443885EDE3C4061BC77135C432055EB0303396BF80D58E147671DB8623F8B59FC76DABA3856A35B859E0092FC889846E359CF78082738A8D4690A380CE1C7212F9F36AAA8849C197EEF7A53DC044EA0C191E6552AFF63ADA273802B8BE3C77 ike 0:AzureVPN:5851: sent IKE msg (AUTH): xxx.xxx.xxx.xxxx:500->yyy.yyy.yyy.yyy:500, len=332, id=cdf6b92965c6f25c/0aa00c68858ee14d:00000001 ike 0: comes yyy.yyy.yyy.yyy:500->xxx.xxx.xxx.xxxx:500,ifindex=5.... ike 0: IKEv2 exchange=AUTH_RESPONSE id=cdf6b92965c6f25c/0aa00c68858ee14d:00000001 len=76 ike 0: in CDF6B92965C6F25C0AA00C68858EE14D2E202320000000010000004C29000030CDFAC022B75853A2E68C1B7A67CCE8CC88138E254E9A54793FA5164AF981D695759FE520A295C2AA38D26B0D ike 0:AzureVPN:5851: dec CDF6B92965C6F25C0AA00C68858EE14D2E2023200000000100000028290000040000000800000018 ike 0:AzureVPN:5851: initiator received AUTH msg ike 0:AzureVPN:5851: received notify type AUTHENTICATION_FAILED ike 0:AzureVPN:5851: schedule delete of IKE SA cdf6b92965c6f25c/0aa00c68858ee14d ike 0:AzureVPN:5851: scheduled delete of IKE SA cdf6b92965c6f25c/0aa00c68858ee14d ike 0:AzureVPN: connection expiring due to phase1 down ike 0:AzureVPN: deleting ike 0:AzureVPN: flushing ike 0:AzureVPN: flushed ike 0:AzureVPN: deleted [/size]

[emnoc]

I highly doubt it but what did you configured in the phase1 settings. The failure is auth but are you using xauth along with PSK or just a PSK? ( confusion )

Typically  if it's a PSK mis-match you get a PSK error in the debug.

What exactly did you configure so we don't have to guess ? ( upload the cfg ....sanitized, so we can review )

ken

[erpmaestro]

emnoc wrote:

I highly doubt it but what did you configured in the phase1 settings. The failure is auth but are you using xauth along with PSK or just a PSK? ( confusion )

Typically  if it's a PSK mis-match you get a PSK error in the debug.

What exactly did you configure so we don't have to guess ? ( upload the cfg ....sanitized, so we can review )

ken

Hello,

I don't see where I can perform this "xauth" configuration. Here is the configuration exporting from the gateway and slightly tweaked to mask some actual values

config vpn ipsec phase1-interface     edit "Site2Site"         set interface "wan"         set ike-version 2         set nattraversal disable         set keylife 28800         set proposal aes256-sha1         set dhgrp 2         set remote-gw [gateway.ip.address]         set psksecret ENC [MagicValues]     next end config vpn ipsec phase2-interface     edit "Site2SitePhase2"         set phase1name "Site2Site"         set proposal aes256-sha1         set dhgrp 1         set keylifeseconds 28800         set src-subnet 192.168.1.0 255.255.255.0         set dst-subnet 10.0.1.0 255.255.255.0     next end

[emnoc]

Your using ikev2

[size="2"]IKEv2 exchange=AUTH_RESPONSE[/size]

[size="2"]

[/size]

So redo the  ikev2  auth parameters to ensure they are correct.

[erpmaestro]

It turns out that I didn't correctly set the public IP in the Azure portal for the firewall device. It was a silly mistake on my part, but it's connected now. No changes on the device configuration.

Thanks for the sugguestions!

[Tech-Tenpo]

What was the change in azure, I have a similar problem