Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
kkbk96
New Contributor II

fortigate 60E ipsec tunnel issue

Trying to bring up VPN from the forticlient on my phone to the firewall which is on version 7.2.0. Phase 1 shows success and thats it.

Logs below, shows timeout so no idea whats happening:

 

ike 0: comes 172.x.x.x:26655->173.x.x.x:500,ifindex=5,vrf=0....

ike 0: IKEv1 exchange=Aggressive id=aaad59c925e55457/0000000000000000 len=572 vrf=0

ike 0: in AAAD59C925E55457000000000000000001100400000000000000023C0400009C000000010000000100000090010100040300002401010000800B0001800C708080010007800E00808003000180020002800400050300002402010000800B0001800C708080010007800E00808003000180020001800400050300002003010000800B0001800C7080800100058003000180020002800400050000002004010000800B0001800C7080800100058003000180020001800400050A0000C40411150C4FDE77C7991600F89A104FB26D1C628FA46398683E32BFAD3070AF3340D665B465372E86C7AFF0F85D555A14B0E686DCFA45F8F314106DB76E41461030BE808BDE15AF3B62F0E47BFE504C96A030432EB60918E2005CE0F50B74D3DDC7F39E689F690331EF5B0284CD9DF4CC6665B43D648938E4B62CD74E98AD36B0C9CFE444431A9D33BDEA628A36B6353B5DBEEE25606D0E7F3222AA1E7DA5DB9AAB9B17E8894BED24C73DF9D9DA75845B25A86BB9333EB6C1C56E45E2E647DE2B05000014B1DC84B7341BE3A5F078B6439A913A3E0D00000C011105DCC00000020D0000144A131C81070358455C5728F20E95452F0D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D0000144485152D18B6BBCD0BE8A8469579DDCC0D00001412F5F28C457168A9702D9FE274CC01000D000014AFCAD71368A1F1C96B8696FC775701000D0000144C53427B6D465D1B337BB755A37A7FEF00000014B4F01CA951E9DA8D0BAFBBD34AD3044E

ike 0:aaad59c925e55457/0000000000000000:0: responder: aggressive mode get 1st message...

ike 0:aaad59c925e55457/0000000000000000:0: VID RFC 3947 4A131C81070358455C5728F20E95452F

ike 0:aaad59c925e55457/0000000000000000:0: VID draft-ietf-ipsec-nat-t-ike-02 CD60464335DF21F87CFDB2FC68B6A448

ike 0:aaad59c925e55457/0000000000000000:0: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F

ike 0:aaad59c925e55457/0000000000000000:0: VID draft-ietf-ipsec-nat-t-ike-00 4485152D18B6BBCD0BE8A8469579DDCC

ike 0:aaad59c925e55457/0000000000000000:0: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100

ike 0:aaad59c925e55457/0000000000000000:0: VID DPD AFCAD71368A1F1C96B8696FC77570100

ike 0:aaad59c925e55457/0000000000000000:0: VID forticlient connect license 4C53427B6D465D1B337BB755A37A7FEF

ike 0:aaad59c925e55457/0000000000000000:0: VID Fortinet Endpoint Control B4F01CA951E9DA8D0BAFBBD34AD3044E

ike 0::0: peer identifier IPV4_ADDR 192.0.0.2

ike 0: cache rebuild start

ike 0:RemoteAccOuts: cached as dynamic

ike 0: cache rebuild done

ike 0: IKEv1 Aggressive, comes 172.x.x.x:26655->173.x.x.x 5

ike 0:aaad59c925e55457/0000000000000000:0: negotiation result

ike 0:aaad59c925e55457/0000000000000000:0: proposal id = 1:

ike 0:aaad59c925e55457/0000000000000000:0: protocol id = ISAKMP:

ike 0:aaad59c925e55457/0000000000000000:0: trans_id = KEY_IKE.

ike 0:aaad59c925e55457/0000000000000000:0: encapsulation = IKE/none

ike 0:aaad59c925e55457/0000000000000000:0: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128

ike 0:aaad59c925e55457/0000000000000000:0: type=OAKLEY_HASH_ALG, val=SHA.

ike 0:aaad59c925e55457/0000000000000000:0: type=AUTH_METHOD, val=PRESHARED_KEY.

ike 0:aaad59c925e55457/0000000000000000:0: type=OAKLEY_GROUP, val=MODP1536.

ike 0:aaad59c925e55457/0000000000000000:0: ISAKMP SA lifetime=86400

ike 0:aaad59c925e55457/0000000000000000:0: SA proposal chosen, matched gateway RemoteAccOuts

ike 0:RemoteAccOuts: created connection: 0x7631148 5 173.x.x.x->172.x.x.x:26655.

ike 0:RemoteAccOuts:0: DPD negotiated

ike 0:RemoteAccOuts:0: peer supports UNITY

ike 0:RemoteAccOuts:0: enable FortiClient license check

ike 0:RemoteAccOuts:0: enable FortiClient endpoint compliance check, use 169.254.1.1

ike 0:RemoteAccOuts:0: selected NAT-T version: RFC 3947

ike 0:RemoteAccOuts:0: generate DH public value request queued

ike 0:RemoteAccOuts:0: compute DH shared secret request queued

ike 0:RemoteAccOuts:0: cookie aaad59c925e55457/60eea0a873701dae

ike 0:RemoteAccOuts:0: ISAKMP SA aaad59c925e55457/60eea0a873701dae key 16:EFA920DB7F8B6F1FC34B32EA19C1353B

ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000

ike 0:RemoteAccOuts:0: sent IKE msg (agg_r1send): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae

ike 0: comes 172.x.x.x:21870->173.x.x.x:4500,ifindex=5,vrf=0....

ike 0: IKEv1 exchange=Informational id=aaad59c925e55457/60eea0a873701dae:99482542 len=92 vrf=0

ike 0: in AAAD59C925E5545760EEA0A873701DAE08100501994825420000005C21D54D2186CCB7DBEACD4AB9F0504F62F49988298A0431E29A4B44FECFE9D047A3650A4FA9C4F7B34610EC46C5166D2648C153AA63B91AD230CD96F33B983E3B

ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000

ike 0:RemoteAccOuts:0: sent IKE msg (P1_RETRANSMIT): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae

ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000

ike 0:RemoteAccOuts:0: sent IKE msg (P1_RETRANSMIT): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae

ike shrank heap by 122880 bytes

ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000

ike 0:RemoteAccOuts:0: sent IKE msg (P1_RETRANSMIT): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae

ike 0:RemoteAccOuts:0: negotiation timeout, deleting

ike 0:RemoteAccOuts: connection expiring due to phase1 down

ike 0:RemoteAccOuts: deleting

ike 0:RemoteAccOuts: deleted

 

172.x.x.x. is my phone ip whereas 173.x.x.x is my fortiagte wan1 ip.

 

For the ipsec tunnel config where is the phase-2 proposal i dont see it, want to match it with the proposals on the forticlient on my phone, i only see phase-1 proposal not phase-2 when i select the tunnel under ipsec tunnel under VPN.

 

Logs on fortigate as you can see only shows phase-1

 

I just tried connecting to the vpn from my laptop (which is on the internal network) to the Fortigate and it worked but if i connect my laptop to say nord vpn so that it can get a public ip and then connect to Fortigate then it doesn't work.

 

Thank You.

5 REPLIES 5
Anthony_E
Community Manager
Community Manager

Hello kkbk96,

 

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

 

Regards,

Anthony-Fortinet Community Team.
Anthony_E
Community Manager
Community Manager

Hello,

 

I have found this KB article which explain how to troubleshoot IPsec VPN tunnels:

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Troubleshooting-IPsec-VPNs/ta-p/195955

 

Could you please tell me if it helps?

 

Regards,

Anthony-Fortinet Community Team.
kkbk96
New Contributor II

So there is nothing wrong with the tunnel itself, it is up, I just can't get to any network, cannot ping etc when on the vpn. So I don't think this kb is going to be helpful.

Anthony_E
Community Manager
Community Manager

Hello,

 

So we will continue to find a solution and we will come back to you ASAP.

 

Regards,

Anthony-Fortinet Community Team.
alif
Staff
Staff

Hello @kkbk96,

 

Please share the IPsec VPN configuration of Fortigate and FortiClient.

 

Please also share the output of the following commands.
show vpn ipsec phase1-interfaceRemoteAccOuts
show vpn ipsec phase2-interface RemoteAccOuts (modify the name if needed)
diag vpn ike gateway list name RemoteAccOuts

Regards,
SFA
Labels
Top Kudoed Authors