VPN's Will not come up. Looked through all settings FortiGate > Draytek Vigor

[Tistopher]

Hello Guys,

Hopefully someone can help!, I have tried NAT-T on and off doesn't do any joy. DPD is disabled. See below config of VPN on FortiGate side, the PSK is definately correct I've reset it loads of times. Basically I just se "sent IKE msg (P1_RETRANSMIT) all the time then the tunnel deletes the connection and resets and goes again. At first I though this might be an issue since both sides do not have static IP's (Only DDNS) - however I tried just to put the IP in that each side currently has and the same issue happens:

Config Below:

config vpn ipsec phase1-interface

    edit "VPN-House"         set type ddns         set interface "wan1"         set peertype any         set net-device disable         set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1         set dpd disable         set dhgrp 2         set remotegw-ddns "someonesDDNS.org"         set psksecret ENC fc2ZqgrLrWOa/CsEj1iW77PkPWytlmFMwe7eJD719tHfrVfyOZmtXQaQkPkh8u1Cc0R5pEciDmlNFCj4pLnRVwHe/JrHjvkcqIkJv2dmGBtE+fw/vtYDhFqWQ/OdOGPME+1WA4hfai8nUIuupQZPpQ2cZsY1DFdoYrPUP7EMy7Uu8ZKNvtykvfUN/1TbHE3Pty2vUA==     next

config vpn ipsec phase2-interface

    edit "VPN-House"         set phase1name "VPN-House"         set proposal aes128-sha1 aes128-md5         set pfs disable         set replay disable         set keylifeseconds 3600         set src-subnet 172.16.10.0 255.255.255.0         set dst-subnet 172.16.32.0 255.255.255.0     next

Debugging Below:

ike 0:VPN-House reset tunnel remote gw X.X.X.X ike 0:VPN-House: schedule auto-negotiate ike 0:VPN-House: deleted ike 0:VPN-House: set oper down ike 0: cache rebuild start ike 0:VPN-House: sending DNS request for remote peer someonesDDNS.org ike 0: send IPv4 DNS query : someonesDDNS.org ike 0:User-VPN: cached as dynamic ike 0: cache rebuild done ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0:VPN-House: sending DNS request for remote peer someonesDDNS.org ike 0: send IPv4 DNS query : someonesDDNS.org ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0:VPN-House: sending DNS request for remote peer someonesDDNS.org ike 0: send IPv4 DNS query : someonesDDNS.org ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0: DNS response received for remote gateway someonesDDNS.org ike 0: DNS someonesDDNS.org -> X.X.X.X ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0:VPN-House: sending DNS request for remote peer someonesDDNS.org ike 0: send IPv4 DNS query : someonesDDNS.org ike 0: DNS response received for remote gateway someonesDDNS.org ike 0: DNS someonesDDNS.org -> X.X.X.X ike 0:VPN-House: 'someonesDDNS.org' resolved to X.X.X.X ike 0:VPN-House: set remote-gw X.X.X.X ike 0: cache rebuild start ike 0:VPN-House: local:X.X.X.X, remote:X.X.X.X ike 0:VPN-House: cached as static-ddns. ike 0:User-VPN: cached as dynamic ike 0: cache rebuild done ike 0:VPN-House: auto-negotiate connection ike 0:VPN-House: created connection: 0x57ff2a8 6 X.X.X.X->X.X.X.X:500. ike 0:VPN-House:126: initiator: main mode is sending 1st message... ike 0:VPN-House:126: cookie 314993691d73b8a8/0000000000000000 ike 0:VPN-House:126: out 314993691D73B8A8000000000000000001100200000000000000019C0D0000B40000000100000001000000A8010100040300002801010000800B0001000C00040001518080010007800E00808003000180020004800400020300002802010000800B0001000C00040001518080010007800E01008003000180020004800400020300002803010000800B0001000C00040001518080010007800E00808003000180020002800400020000002804010000800B0001000C00040001518080010007800E01008003000180020002800400020D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:VPN-House:126: sent IKE msg (ident_i1send): X.X.X.X:500->X.X.X.X:500, len=412, id=314993691d73b8a8/0000000000000000 ike 0:VPN-House:126: out 314993691D73B8A8000000000000000001100200000000000000019C0D0000B40000000100000001000000A8010100040300002801010000800B0001000C00040001518080010007800E00808003000180020004800400020300002802010000800B0001000C00040001518080010007800E01008003000180020004800400020300002803010000800B0001000C00040001518080010007800E00808003000180020002800400020000002804010000800B0001000C00040001518080010007800E01008003000180020002800400020D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:VPN-House:126: sent IKE msg (P1_RETRANSMIT): X.X.X.X:500->X.X.X.X:500, len=412, id=314993691d73b8a8/0000000000000000 ike 0:VPN-House:126: out 314993691D73B8A8000000000000000001100200000000000000019C0D0000B40000000100000001000000A8010100040300002801010000800B0001000C00040001518080010007800E00808003000180020004800400020300002802010000800B0001000C00040001518080010007800E01008003000180020004800400020300002803010000800B0001000C00040001518080010007800E00808003000180020002800400020000002804010000800B0001000C00040001518080010007800E01008003000180020002800400020D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:VPN-House:126: sent IKE msg (P1_RETRANSMIT): X.X.X.X:500->X.X.X.X:500, len=412, id=314993691d73b8a8/0000000000000000 ike 0:VPN-House:126: out 314993691D73B8A8000000000000000001100200000000000000019C0D0000B40000000100000001000000A8010100040300002801010000800B0001000C00040001518080010007800E00808003000180020004800400020300002802010000800B0001000C00040001518080010007800E01008003000180020004800400020300002803010000800B0001000C00040001518080010007800E00808003000180020002800400020000002804010000800B0001000C00040001518080010007800E01008003000180020002800400020D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:VPN-House:126: sent IKE msg (P1_RETRANSMIT): X.X.X.X:500->X.X.X.X:500, len=412, id=314993691d73b8a8/0000000000000000 ike 0:VPN-House:126: negotiation timeout, deleting ike 0:VPN-House: connection expiring due to phase1 down ike 0:VPN-House: deleting ike 0:VPN-House reset tunnel remote gw X.X.X.X ike 0:VPN-House: schedule auto-negotiate ike 0:VPN-House: deleted ike 0:VPN-House: set oper down ike 0: cache rebuild start ike 0:VPN-House: sending DNS request for remote peer someonesDDNS.org ike 0: send IPv4 DNS query : someonesDDNS.org ike 0:User-VPN: cached as dynamic ike 0: cache rebuild done ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0: DNS response received for remote gateway someonesDDNS.org ike 0: DNS someonesDDNS.org -> X.X.X.X ike 0:VPN-House: remote IPv4 DDNS gateway is empty, retry to resolve it ike 0:VPN-House: 'someonesDDNS.org' resolved to X.X.X.X ike 0:VPN-House: set remote-gw X.X.X.X ike 0: cache rebuild start ike 0:VPN-House: local:X.X.X.X, remote:X.X.X.X ike 0:VPN-House: cached as static-ddns. ike 0:User-VPN: cached as dynamic ike 0: cache rebuild done ike 0:VPN-House: auto-negotiate connection ike 0:VPN-House: created connection: 0x57ff2a8 6 X.X.X.X->X.X.X.X:500. ike 0:VPN-House:127: initiator: main mode is sending 1st message... ike 0:VPN-House:127: cookie 352ad45f8151c5d0/0000000000000000 ike 0:VPN-House:127: out 352AD45F8151C5D0000000000000000001100200000000000000019C0D0000B40000000100000001000000A8010100040300002801010000800B0001000C00040001518080010007800E00808003000180020004800400020300002802010000800B0001000C00040001518080010007800E01008003000180020004800400020300002803010000800B0001000C00040001518080010007800E00808003000180020002800400020000002804010000800B0001000C00040001518080010007800E01008003000180020002800400020D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000 ike 0:VPN-House:127: sent IKE msg (ident_i1send): X.X.X.X:500->X.X.X.X:500, len=412, id=352ad45f8151c5d0/0000000000000000 Home-FortiWiFi # diike 0:VPN-House:127: out 352AD45F8151C5D0000000000000000001100200000000000000019C0D0000B40000000100000001000000A8010100040300002801010000800B0001000C00040001518080010007800E00808003000180020004800400020300002802010000800B0001000C00040001518080010007800E01008003000180020004800400020300002803010000800B0001000C00040001518080010007800E00808003000180020002800400020000002804010000800B0001000C00040001518080010007800E01008003000180020002800400020D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000

Thanks,

Chris

[emnoc]

The problem is obvious   based on the following 

"ike 0:VPN-House:126: negotiation timeout, deleting"

So you sent to some address/name and no reply is that device ( remote-gw) correct? Humor me, have some give you the public-address that that the suspect dyndns item is using, put that into you cfg. Do you get a reply?

NAT-T and DPD is not the issue at this point. You need to explore why the device x.x.x.x:500 did not reply.

Ken Felix

[ede_pfau]

hi,

you can see that one of the firewalls (the FGT) is behind a NAT device, as traffic switches to udp/500. Make sure the Draytek can handle NAT-T (NAT traversal).

And I'm not sure the Draytek supports SHA256, I'd try the lowest available setting until the VPN is up.

[rwpatterson]

Also on the Fortigate side, you will need to create at least one policy that leverages that tunnel before anything will happen.

[Tistopher]

Cheers Guys,

This tunnel used to work till I moved house, The Policies are in place a long with the static route to other end's subnet. I can see yes now that it times out. I have looked on the Draytek side and AES128-SHA1 DIFF 14.

It resolves the correct DDNS IP as I can see that through the capture. Unfortunately Drayteks don't offer very good troubleshooting. My only other guess is to update the Draytek's firmware....

Something I thought I shouldn't have to do, other than that the config is pretty simple, I havn't enabled PFS Draytek side so disabled it FortiGate side.

I just rebooted both devices to see if it would make a difference and it doesn't :\

Cheers,

Chris

[emnoc]

NAT-T is using udp 4500 fwiw and yes a policy is required, but typically on debug it will reflect that & if you have no policy for the traffic to be encrypted

Ken Felix

[ede_pfau]

It will switch to udp/4500 if behind a router, but only when ESP is not available. AH does not survice NAT, but (?) maybe ESP does.

Thought so with SHA1, Drayteks (like FritzBox and other consumer grade home routers) are not especially crafted for IPsec service. Still, if it worked before and you haven't changed the config, it should work now.

[Tistopher]

Only thing that has changed is i've gone to 6.4.3 from probably 6.0 before and i've moved house and unfortunately Sky is my service provider. However I don't believe they will block it in anyway.

My only thinking is bring the Draytek up to latest release too.

[ede_pfau]

why do people upgrade to the latest bleeding edge release as soon as it's released?

You could as well revert to 6.0.11 and check that. You just need the 6.0 config to restore it after downgrading:

- install lower version of firmware

- "exec factoryreset"

- restore old config file

[emnoc]

If  you do a "diag sniffer packet any  udp port 500/4500" do you see anything coming back?

Ken Felix