Troubleshoot pre-shared key mismatch

[qrz]

Hello.

I tried to debug non-working VPN tunnel and suspect there is PSK mismatch.

Fortigate doc says: "It is possible to identify a PSK mismatch using the following combination of CLI commands:

diag debug app ike filter name "phase1-name"

...

I got an error after this command, "command parse error before 'name'", why ? Are there any ways to do this ?

My Fortigate version is v5.6.4

[sw2090 · Accepted solution]

you have to replace phase1-name by the name of your tunnel. However this filter is still  broken in 5.6 (and it was before 5.6) and will not work even if you set it. This is very annoying if you have more vpns running.

I work around that by doing diag debug app ike -1. LEt it run for a while and then copy-paste the output into a text editor where I can search it.

[sw2090 · Accepted solution]

hm that looks more like non matching proposals in phase1 than a psk mismatch. Could you check that you have at least one pair of proposals identical on both sides?

[ede_pfau · Accepted solution]

Yes.

The incoming proposal is AES128/SHA256 with PFS group 5.

Usually (best practice) you would only configure one proposal on each side. Check NATT and DPD as well.

[emnoc · Accepted solution]

Agreed

PSK mis-match is not the issue and diag debug app ike -1 is your friend. Set a filter if you have tons or IKE gateways.

e.g 

   diag vpn ike  filter name <insert phase1 name> I'm doing that at this exact moment and with a FGT with 300 vpns ;) Ken Felix

[sw2090 · Accepted solution]

yeah this one is clear to me ;)

It now matched proposals but refused to bring the tunnel up because there is no policy for the tunnel traffic on your FGT: 

So create a policy (at least one) that affects tunnel traffic and it should come up.