Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
OSSATR
New Contributor

VPIPSEC VPN PROBLEM

Hi, I'm trying to configure a VPN tunnel between FortiGate and Palo Alto. Phase 1 is successful, but the VPN tunnel is not coming up. After diagnosing the issue, I found this problem:

ike 0:T-VPN X:12737: out 636683CBD27BF67700000000000000002120220800000000000001AC2200005C0200002C010100040300000C0100000C800E010003000008020000020300000803000002000000080400000E0000002C020100040300000C0100000C800E01000300000802000005030000080300000C000000080400000E28000108000E0000B8790CEC9BFDC31B0F762FA7CB120D169EDD571D1757312098873945ACACFE915F191029EB5B54348D28A2082E0DA8E089E737365ADFC4AD04666130400EF8005A1D984C42B5807F4CAC7D6585A7EA1D0E78A8179E475CE34C4BF72C81C0995CDF3E6E19EB88A80280F8BDEB5C6FA1C76799529FC53353A36020760F02A7E57D4B825283F45F8C9F13B331109703827E0B5CE1883C65F9CC845888583B83918334FA1F9123B197769CD78D06867D0B19C716EB4130D78F06EF1854FEE82C794D9C4871335B5F84D792A441330780A64FD0601B62EAB1F2652C95D91F87ECD18D61982529F9283CF4E30D2F80857FE9534C995A1D47BCA4D4F4F5E9EA6DB09F1A29000024BB84B7A9F56403EA4490792EF60D18BF5F2D21FEA18893B5B9F0BAA0779B4439000000080000402E
ike V=root:0:T-VPN X:12737: sent IKE msg (RETRANSMIT_SA_INIT): A.A.A.A:500->B.B.B.B:500, len=428, vrf=0, id=636683cbd27bf677/0000000000000000, oif=16
ike V=root:0:T-VPN X:T-VPN X: IPsec SA connect 16 A.A.A.A-->B.B.B.B:0
ike V=root:0:T-VPN X:T-VPN X: using existing connection
ike V=root:0:T-VPN MX:T-VPN X: config found
ike V=root:0:T-VPN X: request is on the queue
ike V=root:0:T-VPN X:T-VPN X: IPsec SA connect 16 A.A.A.A-->B.B.B.B:0
ike V=root:0:T-VPN X:T-VPN X: using existing connection
ike V=root:0:T-VPN X:T-VPN X: config found
ike V=root:0:T-VPN X: request is on the queue
ike V=root:0:T-VPN X:T-VPN X: IPsec SA connect 16 A.A.A.A-->B.B.B.B:0
ike V=root:0:T-VPN X:T-VPN X: using existing connection
ike V=root:0:T-VPN X:T-VPN X: config found
ike V=root:0:T-VPN X: request is on the queue

A.A.A.A is the Ip address of my wan interface and B.B.B.B is the public ip address for the palo alto side.

2 REPLIES 2
ozkanaltas
Valued Contributor II

Hello @OSSATR ,

 

I saw a private IP(192.168.55.12) in the logs. Did you enable nat-traversal mutually?

 

If your firewall is behind the nat device(router, modem, etc.), you need to use nat-t on ipsec configuration.

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
ede_pfau
SuperUser
SuperUser

The FGT sent packets out to UDP/500 which are not answered. This indicates that NAT traversal (NAT-T) is not active on the PA side, as @ozkanaltas pointed out as well.

 

My guess is that A.A.A.A is 192.168.55.12, and you overlooked one occasion. Which is good in this case. Completely hiding IP addresses might obscure the root cause - next time, try to only hide public IPs so that a reader can distinguish between private and public addresses while not giving away valuable info.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors