VPN IPSec between two fortigate: phase 1 ike msg retransmit

[luca1994]

Hello team,

this is the scenario:

IPSec peers are both public ip so I left NAT-T disabled and enabled DPD Peer detection on demand for both firewalls.
As authentication I set PSK, IKEv1 Main (id protection) for both firewalls.
For the Phase1 Proposal part I configured AES256-SHA1 and DH 21 and 2 for both firewalls.
After that I configured the relevant policies and static route for both firewalls.

The problem is that phase1 does not go up. Running some debugging I see this in the logs:

I also ran a packet capture and I see traffic on port 500 for both firewalls:

Thanks in advance for the support

BR

[AEK]

Hi Luca

Check on your local FG if the remote peer IP is set on some interface or as VIP or IP pool.

[luca1994]

Hi @AEK ,

the remote peer IP is set on interface, also local peer.

BR

[AEK · Accepted solution]

Hi Luca

I mean your issue may occur if the remote peer IP (FG-B) is conflicting with an IP set on the local FortiGate (FG-A).

Try check on FG-A may be you have a VIP or IP pool that contains the remote peer IP. In that case during negotiation packets are sent to the local FG instead of FG-B.

[hbac]

Hi @luca1994,

Can you run debugs on the other side? 

Regards,