VPN IPsec LANCOM <-> Fortigate not working

[marc10k]

Hello

I am trying to establish a VPN connection between a Fortigate 60D (v5.4.0) and a LANCOM 7100 VPN and have some problems. The peer IDs, passwords, DH groups and proposals are from my point of view correctly set in both routers. 

The connection should be established from the Fortigate to the LANCOM everytime it has internet access. When a computer in the LANCOM LAN tries to connect to the 10.219.219.0/24 IP range the data should be directed to the Fortigate LAN via VPN. The computer has a route and the LANCOM will then divert the traffic when the VPN connection is established. 

I have started by using the VPN creation wizard for two Fortigate Routers and this worked fine in a LAN environment. Then I converted one of them into a custom connection and changed the peer IDs, passwords, DH groups, proposals and IPs needed for the LANCOM setup. I have attached the debug log from the Fortigate and LANCOM, where HQ_INTERNET_IP the public IPv4 address of the LANCOM router and BRANCH_INTERNET_IP the public IP of the branch is. Upto now I have always only used LANCOM devices and their wizards which did not involve going to much into detail. 

Does someone has an idea what is going wrong and if it is even possible to connect LANCOM with a Fortigate via VPN?

With regards

Marc

Test_VPN # diagnose debug application ike -1
Test_VPN # diagnose debug enable

ike 0:Test VPN:107: add INITIAL-CONTACT
ike 0:Test VPN:107: enc D9ACD7B126184B43CF869C4AFA31E94B0810040100000000000000741400001422E7BA8BC86228EC59A09845C061685A14000014CC6B09DAE8C80A365FDD279D66C86B230B000014BF12BDA514A2610F61AFB161D35B1AD00000001C0000B
ike 0:Test VPN:107: out D9ACD7B126184B43CF869C4AFA31E94B08100401000000000000007CD1C7CB4BFA0A3FCD94F97CA7DE8D058AF77E5594BED2FD403E553F8F7C72D6314240A1F097AB97B66CEC8E98DB2A4F2CE1DA0C41153BE54F61216CF67974638D58F63
ike 0:Test VPN:107: sent IKE msg (agg_i2send): 192.168.100.251:4500->HQ_INTERNET_IP:4500, len=124, id=d9acd7b126184b43/cf869c4afa31e94b
ike 0:Test VPN:107: established IKE SA d9acd7b126184b43/cf869c4afa31e94b
ike 0:Test VPN: set oper up
ike 0:Test VPN: schedule auto-negotiate
ike 0:Test VPN:107: no pending Quick-Mode negotiations
ike 0:Test VPN: carrier up
diagnose debug ike 0:Test VPN:Test VPN: IPsec SA connect 5 192.168.100.251->HQ_INTERNET_IP:4500
ike 0:Test VPN:Test VPN: using existing connection
ike 0:Test VPN:Test VPN: config found
ike 0:Test VPN:Test VPN: IPsec SA connect 5 192.168.100.251->HQ_INTERNET_IP:4500 negotiating
ike 0:Test VPN:107: cookie d9acd7b126184b43/cf869c4afa31e94b:3874122b
ike 0:Test VPN:107:Test VPN:111: natt flags 0x13, encmode 1->3
ike 0:Test VPN:107:Test VPN:111: initiator selectors 0 0:10.219.219.0/255.255.255.0:0:0->0:10.10.100.0/255.255.255.0:0:0
ike 0:Test VPN:107: enc D9ACD7B126184B43CF869C4AFA31E94B081020013874122B0000011401000014F12B72D64435B8EEF8D7015057C5C0010A0000B00000000100000001000000A40103040636CA887B0300001C010C0000800100018002A8C08004000380060
ike 0:Test VPN:107: out D9ACD7B126184B43CF869C4AFA31E94B081020013874122B0000011C5C1C0CA8955E7A5A742D9A0A88711CDAB8AE2128B7AC94487A43D94097D7456D2DBCD501E89B7BAC4E5A6C3DD3568F06BEDD6A19EEFAE7FBB1A30249D21984A39B8DB
ike 0:Test VPN:107: sent IKE msg (quick_i1send): 192.168.100.251:4500->HQ_INTERNET_IP:4500, len=284, id=d9acd7b126184b43/cf869c4afa31e94b:3874122b
ike 0: comes HQ_INTERNET_IP:4500->192.168.100.251:4500,ifindex=5....
ike 0: IKEv1 exchange=Informational id=d9acd7b126184b43/cf869c4afa31e94b:ee0b8b0e len=60
ike 0: in D9ACD7B126184B43CF869C4AFA31E94B08100501EE0B8B0E0000003C38407FB16B5292DD10F914A192B714C0F80C2352946128835226F0DEAA91DC33
ike 0:Test VPN:107: dec D9ACD7B126184B43CF869C4AFA31E94B08100501EE0B8B0E0000003C0B0000145D788A7F832FE95E20F433A7EFA64B420000000C000000010100000E
ike 0:Test VPN:107: notify msg received: NO-PROPOSAL-CHOSEN
ike 0:Test VPN:107:: no matching IPsec SPI
ike 0:Test VPN:107:Test VPN:111: delete phase2 SPI 7b88ca36
ike 0: comes HQ_INTERNET_IP:4500->192.168.100.251:4500,ifindex=5....
ike 0: IKEv1 exchange=Informational id=d9acd7b126184b43/cf869c4afa31e94b:3f64bbf5 len=76
ike 0: in D9ACD7B126184B43CF869C4AFA31E94B081005013F64BBF50000004CDD9BFBC2AF198CBE597C2F9E55A67BAECD22A06A85AF1A34ACE9D4759AA37A7EB568DA80D006F874628BA6396AE8132B
ike 0:Test VPN:107: dec D9ACD7B126184B43CF869C4AFA31E94B081005013F64BBF50000004C0C000014C1403CA46F29759F81A7C5638E2C8AF70000001C0000000101100001D9ACD7B126184B43CF869C4AFA31E94B
ike 0:Test VPN:107: recv ISAKMP SA delete d9acd7b126184b43/cf869c4afa31e94b
ike 0:Test VPN: deleting
ike 0:Test VPN: flushing
ike 0:Test VPN: flushed
ike 0:Test VPN: reset NAT-T
ike 0:Test VPN: deleted
ike 0:Test VPN: set oper down
ike 0:Test VPN: schedule auto-negotiate
ike 0:Test VPN: carrier down
disable ike 0:Test VPN: auto-negotiate connection
ike 0:Test VPN: created connection: 0x290b860 5 192.168.100.251->HQ_INTERNET_IP:500.
ike 0:Test VPN:108: initiator: aggressive mode is sending 1st message...
ike 0:Test VPN:108: cookie 3c103800ae8523f6/0000000000000000
ike 0:Test VPN:108: out 3C103800AE8523F60000000000000000011004000000000000000288040000F40000000100000001000000E8010100060300002801010000800B0001000C00040001518080010007800E00808003000180020001800400020300002802013
ike 0:Test VPN:108: sent IKE msg (agg_i1send): 192.168.100.251:500->HQ_INTERNET_IP:500, len=648, id=3c103800ae8523f6/0000000000000000
ike 0: comes HQ_INTERNET_IP:500->192.168.100.251:500,ifindex=5....
ike 0: IKEv1 exchange=Aggressive id=3c103800ae8523f6/5f3922b6ddd65653 len=432
ike 0: in 3C103800AE8523F65F3922B6DDD656530110040000000000000001B00400003C000000010000000100000030010100010000002801010000800B0001000C00040001518080010007800E00808003000180020001800400020A0000844F676E9B216EF699D41
ike 0:Test VPN:108: initiator: aggressive mode get 1st response...
ike 0:Test VPN:108: VID unknown (16): EEEFA37809E32AD4DE4F6B010C26A640
ike 0:Test VPN:108: VID draft-ietf-ipsra-isakmp-xauth-06.txt 09002689DFD6B712
ike 0:Test VPN:108: VID DPD AFCAD71368A1F1C96B8696FC77570100
ike 0:Test VPN:108: DPD negotiated
ike 0:Test VPN:108: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F
ike 0:Test VPN:108: VID draft-ietf-ipsec-nat-t-ike-03 7D9419A65310CA6F2C179D9215529D56
ike 0:Test VPN:108: VID RFC 3947 4A131C81070358455C5728F20E95452F
ike 0:Test VPN:108: received peer identifier FQDN 'VPN_Service'
ike 0:Test VPN:108: negotiation result
ike 0:Test VPN:108: proposal id = 1:
ike 0:Test VPN:108: protocol id = ISAKMP:
ike 0:Test VPN:108: trans_id = KEY_IKE.
ike 0:Test VPN:108: encapsulation = IKE/none
ike 0:Test VPN:108: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128
ike 0:Test VPN:108: type=OAKLEY_HASH_ALG, val=MD5.
ike 0:Test VPN:108: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:Test VPN:108: type=OAKLEY_GROUP, val=MODP1024.
ike 0:Test VPN:108: ISAKMP SA lifetime=86400
ike 0:Test VPN:108: selected NAT-T version: RFC 3947
ike 0:Test VPN:108: NAT detected: ME
ike 0:Test VPN:108: ISAKMP SA 3c103800ae8523f6/5f3922b6ddd65653 key 16:B89CA01028B1FDB0C83E6C1C00880C5D
ike 0:Test VPN:108: PSK authentication succeeded
ike 0:Test VPN:108: authentication OK
ike 0:Test VPN:108: NAT-T float port 4500

[code lang=vb]  Connection #52 ikev1 10.219.219.253/255.255.255.255:0 <-> 10.219.219.0/255.255.255.0:0 any

    Name: FORTIGATE_60D
    Unique Id: ipsec-0-FORTIGATE_60D-pr0-l0-r0
    Flags: aggressive-mode
    Local Network: IPV4_ADDR(any:0, 10.219.219.253/255.255.255.255)
    Local Gateway: IPV4_ADDR(any:0, HQ_INTERNET_IP)
    Remote Gateway: IPV4_ADDR(any:0, BRANCH_INTERNET_IP)
    Remote Network: IPV4_ADDR_SUBNET(any:0, 10.219.219.0/255.255.255.0)

[ShowCmd] 2016/04/14 10:56:20,041
Result of command: "show bootlog "
Boot log (162 Bytes):

****

04/13/2016 14:18:21 System boot after power on

DEVICE: LANCOM 7100 VPN
HW-RELEASE: B
VERSION: 9.10.0382RU1 / 22.08.2015

[Sysinfo] 2016/04/14 10:56:20,251
Result of command: "sysinfo"

DEVICE: LANCOM 7100 VPN
HW-RELEASE: B
SERIAL-NUMBER: 217941800002
MAC-ADDRESS: 00a057148607
IP-ADDRESS: 192.168.11.254
IP-NETMASK: 255.255.0.0
INTRANET-ADDRESS: 0.0.0.0
INTRANETMASK: 0.0.0.0
LANCAPI-PORT: 75
VERSION: 9.10.0382RU1 / 22.08.2015
VERSION-GIT: 4a09f32cbbc018ff7479f1be36d45d4f7d91e7aa
NAME: Gema_Service
CONFIG-STATUS: 1056;0;51b37b3dbf1bf9f34a7d42c221786d1ae4f9e152.06425914042016.671
FIRMWARE-STATUS: 0;0.8;0.1;9.10RU1.22082015.8;9.04RU4.24032015.7
HW-MASK: 00000000000000000000000000000011
FEATUREWORD: 00000000001000000001000000011110
REGISTERED-WORD: 00000000001000000001000100011110
FEATURE-LIST: 01/I
FEATURE-LIST: 02/F
FEATURE-LIST: 03/F
FEATURE-LIST: 04/F
FEATURE-LIST: 08/H
FEATURE-LIST: 0c/F
FEATURE-LIST: 15/F
TIME: 10561914042016
HTTP-PORT: 80
HTTPS-PORT: 443
TELNET-PORT: 23
TELNET-SSL-PORT: 992
SSH-PORT: 22
SNMP-PORT: 161
TFTP-PORT: 69
LOCATION: 0
COUNTRY-CODE: 0/0 (NA)
COMMENT: VPN Service Router
MYVPN: 0
MYVPN-HOSTNAME:
EXTENDED-NAME: LANCOM 7100 VPN
SNMP-PASSWORD-REQ: 0

[Table] 2016/04/14 10:56:20,452
Content of table: /Status/VPN/DH-Groups/Precalculation

DH-Group Rule-Dependent-Target Configured-Target Actual-Target Current-Stock
----------------------------------------------------------------------------
1 0 0 0 0
2 148 0 148 146
5 4 0 4 4
14 0 0 0 0
[Value] 2016/04/14 10:56:20,652
Content of node: /Status/VPN/IKE-SAs
  25
[VPN-Status] 2016/04/14 10:56:19,908 Devicetime: 2016/04/14 10:56:19,824
VPN: FORTIGATE_60D (0.0.0.0) disconnected

[VPN-Status] 2016/04/14 10:56:21,173 Devicetime: 2016/04/14 10:56:20,895
IKE info: Phase-1 [responder] got INITIAL-CONTACT from peer FORTIGATE_60D (BRANCH_INTERNET_IP)

[VPN-Status] 2016/04/14 10:56:21,173 Devicetime: 2016/04/14 10:56:20,895
IKE info: Phase-1 [responder] for peer FORTIGATE_60D initiator id Fortigate60D, responder id GEMA_SERVICE
IKE info: initiator cookie: 0x027135582db61e10, responder cookie: 0x0e4aa9a053b7b76b
IKE info: NAT-T enabled in mode rfc, we are not behind a nat, the remote side is behind a nat
IKE info: SA ISAKMP for peer FORTIGATE_60D encryption aes-cbc authentication MD5
IKE info: life time ( 86400 sec/ 0 kb) DPD 0 sec

[VPN-Status] 2016/04/14 10:56:21,173 Devicetime: 2016/04/14 10:56:20,895
IKE info: Phase-1 SA Rekeying Timeout (Soft-Event) for peer FORTIGATE_60D set to 77760 seconds (Responder)

[VPN-Status] 2016/04/14 10:56:21,173 Devicetime: 2016/04/14 10:56:20,896
IKE info: Phase-1 SA Timeout (Hard-Event) for peer FORTIGATE_60D set to 86400 seconds (Responder)

[VPN-Status] 2016/04/14 10:56:24,158 Devicetime: 2016/04/14 10:56:23,882
IKE info: ISAKMP_NOTIFY_DPD_R_U_THERE sent for Phase-1 SA to peer FORTIGATE_60D, sequence nr 0x363be5ea

[VPN-Status] 2016/04/14 10:56:24,166 Devicetime: 2016/04/14 10:56:23,912
IKE info: NOTIFY received of type ISAKMP_NOTIFY_DPD_R_U_THERE_ACK for peer FORTIGATE_60D Seq-Nr 0x363be5ea, expected 0x363be5ea

[VPN-Status] 2016/04/14 10:56:24,896 Devicetime: 2016/04/14 10:56:24,790
IKE info: Phase-2 failed for peer FORTIGATE_60D: no rule matches the phase-2 ids 10.219.219.0/255.255.255.0 <-> 10.10.100.0/255.255.255.0
IKE log: 105624.790688 Default message_negotiate_sa: no compatible proposal found
IKE log: 105624.790743 Default dropped message from BRANCH_INTERNET_IP port 4500 due to notification type NO_PROPOSAL_CHOSEN

[VPN-Status] 2016/04/14 10:56:24,897 Devicetime: 2016/04/14 10:56:24,792
policy manager error indication: FORTIGATE_60D (BRANCH_INTERNET_IP), cause: 12801

[VPN-Status] 2016/04/14 10:56:24,897 Devicetime: 2016/04/14 10:56:24,792
VPN: WAN state changed to WanCalled for FORTIGATE_60D (0.0.0.0), called by: 009bf738

[VPN-Status] 2016/04/14 10:56:24,897 Devicetime: 2016/04/14 10:56:24,792
VPN: Error: IPSEC-R-No-rule-matched-IDs (0x3201) for FORTIGATE_60D (BRANCH_INTERNET_IP)

[VPN-Status] 2016/04/14 10:56:24,897 Devicetime: 2016/04/14 10:56:24,792
vpn-maps[86], remote: FORTIGATE_60D, idle, static-name

[VPN-Status] 2016/04/14 10:56:24,897 Devicetime: 2016/04/14 10:56:24,792
selecting next remote gateway using strategy eFirst for FORTIGATE_60D
     => no remote gateway selected

[VPN-Status] 2016/04/14 10:56:24,897 Devicetime: 2016/04/14 10:56:24,792
selecting first remote gateway using strategy eFirst for FORTIGATE_60D
     => no remote gateway selected

[VPN-Status] 2016/04/14 10:56:24,897 Devicetime: 2016/04/14 10:56:24,792
VPN: installing ruleset for FORTIGATE_60D (0.0.0.0)

[VPN-Status] 2016/04/14 10:56:24,897 Devicetime: 2016/04/14 10:56:24,792
VPN: WAN state changed to WanDisconnect for FORTIGATE_60D (0.0.0.0), called by: 009bf738

[VPN-Status] 2016/04/14 10:56:24,897 Devicetime: 2016/04/14 10:56:24,797
VPN: WAN state changed to WanIdle for FORTIGATE_60D (0.0.0.0), called by: 009bf738

[VPN-Status] 2016/04/14 10:56:24,897 Devicetime: 2016/04/14 10:56:24,803
IKE info: Delete Notification sent for Phase-1 SA to peer FORTIGATE_60D, cookies [0x027135582db61e10 0x0e4aa9a053b7b76b]

[VPN-Status] 2016/04/14 10:56:24,897 Devicetime: 2016/04/14 10:56:24,803
IKE info: Phase-1 SA removed: peer FORTIGATE_60D rule FORTIGATE_60D removed

[VPN-Status] 2016/04/14 10:56:24,897 Devicetime: 2016/04/14 10:56:24,816
VPN: FORTIGATE_60D (0.0.0.0) disconnected

[TraceStopped] 2016/04/14 10:56:39,717

[ede_pfau]

hi,

local and remote subnet in the QM selectors of phase2 are overlapping in the LANCOM config from what I see in the second log. One of them is a host route (/32) which is wrong as well.

BTW, why aggressive mode? This should be a plain site2site VPN in main mode, with NAT-T on one side.

[marc10k]

Hi

I have the VPN connection working now. It was a problem with the remote/local IP in my 60D. Unfortunately I can not get any data through. At the moment I am not sure where the problem is. 

The wizard did the setup for the IPv4 policy and installed a static route. How do I see if traffic is coming to my 60D?

Marc