VPN IPSec ignoring IKEv2 request, no policy configured

[luca1994]

Hello team,

I have configured VPN IPSec from PA to FGT but the pahse1 still down.

I have enabled the debug from fortigate's CLI and following the results:

debug commands:

diag debug reset
diag debug console timestamp enable
diag debug application ike -1
diag debug enable

debug output:

ignoring IKEv2 request, no policy configured

The peer from FGT is a public ip configured on WAN interface directly.

Do you have any suggestions?

Thanks for the support

BR

[funkylicious]

do you have firewall policies for the traffic / routes for the tunnel ?

[luca1994]

Hello @funkyliciousm,

i don't have any policies for traffic IKE. I need configure witch type of policy?

In this way?

config firewall policy
edit n
set name "vpn-test"
set srcintf "WAN"
set dstintf "WAN"
set srcaddr "remote peer"
set dstaddr "FGT peer"
set action accept
set schedule always
set service IKE
set logtraffic all
next
end

Thanks

BR

[funkylicious]

you would need to configure firewall rules with source interface or destination interface, the IPsec tunnel and whatever internal interface you would need to access/be access and could leave source/destination address any and service all.

you could read this documentation on how to create an ipsec tunnel, https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/913287/basic-site-to-site-vp... 

https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/806643/vpn-security-policies 

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IKE-error-no-policy-configured/ta-p/...