Trying to bring up VPN from the forticlient on my phone to the firewall which is on version 7.2.0. Phase 1 shows success and thats it.
Logs below, shows timeout so no idea whats happening:
ike 0: comes 172.x.x.x:26655->173.x.x.x:500,ifindex=5,vrf=0....
ike 0: IKEv1 exchange=Aggressive id=aaad59c925e55457/0000000000000000 len=572 vrf=0
ike 0: in AAAD59C925E55457000000000000000001100400000000000000023C0400009C000000010000000100000090010100040300002401010000800B0001800C708080010007800E00808003000180020002800400050300002402010000800B0001800C708080010007800E00808003000180020001800400050300002003010000800B0001800C7080800100058003000180020002800400050000002004010000800B0001800C7080800100058003000180020001800400050A0000C40411150C4FDE77C7991600F89A104FB26D1C628FA46398683E32BFAD3070AF3340D665B465372E86C7AFF0F85D555A14B0E686DCFA45F8F314106DB76E41461030BE808BDE15AF3B62F0E47BFE504C96A030432EB60918E2005CE0F50B74D3DDC7F39E689F690331EF5B0284CD9DF4CC6665B43D648938E4B62CD74E98AD36B0C9CFE444431A9D33BDEA628A36B6353B5DBEEE25606D0E7F3222AA1E7DA5DB9AAB9B17E8894BED24C73DF9D9DA75845B25A86BB9333EB6C1C56E45E2E647DE2B05000014B1DC84B7341BE3A5F078B6439A913A3E0D00000C011105DCC00000020D0000144A131C81070358455C5728F20E95452F0D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D0000144485152D18B6BBCD0BE8A8469579DDCC0D00001412F5F28C457168A9702D9FE274CC01000D000014AFCAD71368A1F1C96B8696FC775701000D0000144C53427B6D465D1B337BB755A37A7FEF00000014B4F01CA951E9DA8D0BAFBBD34AD3044E
ike 0:aaad59c925e55457/0000000000000000:0: responder: aggressive mode get 1st message...
ike 0:aaad59c925e55457/0000000000000000:0: VID RFC 3947 4A131C81070358455C5728F20E95452F
ike 0:aaad59c925e55457/0000000000000000:0: VID draft-ietf-ipsec-nat-t-ike-02 CD60464335DF21F87CFDB2FC68B6A448
ike 0:aaad59c925e55457/0000000000000000:0: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F
ike 0:aaad59c925e55457/0000000000000000:0: VID draft-ietf-ipsec-nat-t-ike-00 4485152D18B6BBCD0BE8A8469579DDCC
ike 0:aaad59c925e55457/0000000000000000:0: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100
ike 0:aaad59c925e55457/0000000000000000:0: VID DPD AFCAD71368A1F1C96B8696FC77570100
ike 0:aaad59c925e55457/0000000000000000:0: VID forticlient connect license 4C53427B6D465D1B337BB755A37A7FEF
ike 0:aaad59c925e55457/0000000000000000:0: VID Fortinet Endpoint Control B4F01CA951E9DA8D0BAFBBD34AD3044E
ike 0::0: peer identifier IPV4_ADDR 192.0.0.2
ike 0: cache rebuild start
ike 0:RemoteAccOuts: cached as dynamic
ike 0: cache rebuild done
ike 0: IKEv1 Aggressive, comes 172.x.x.x:26655->173.x.x.x 5
ike 0:aaad59c925e55457/0000000000000000:0: negotiation result
ike 0:aaad59c925e55457/0000000000000000:0: proposal id = 1:
ike 0:aaad59c925e55457/0000000000000000:0: protocol id = ISAKMP:
ike 0:aaad59c925e55457/0000000000000000:0: trans_id = KEY_IKE.
ike 0:aaad59c925e55457/0000000000000000:0: encapsulation = IKE/none
ike 0:aaad59c925e55457/0000000000000000:0: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128
ike 0:aaad59c925e55457/0000000000000000:0: type=OAKLEY_HASH_ALG, val=SHA.
ike 0:aaad59c925e55457/0000000000000000:0: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:aaad59c925e55457/0000000000000000:0: type=OAKLEY_GROUP, val=MODP1536.
ike 0:aaad59c925e55457/0000000000000000:0: ISAKMP SA lifetime=86400
ike 0:aaad59c925e55457/0000000000000000:0: SA proposal chosen, matched gateway RemoteAccOuts
ike 0:RemoteAccOuts: created connection: 0x7631148 5 173.x.x.x->172.x.x.x:26655.
ike 0:RemoteAccOuts:0: DPD negotiated
ike 0:RemoteAccOuts:0: peer supports UNITY
ike 0:RemoteAccOuts:0: enable FortiClient license check
ike 0:RemoteAccOuts:0: enable FortiClient endpoint compliance check, use 169.254.1.1
ike 0:RemoteAccOuts:0: selected NAT-T version: RFC 3947
ike 0:RemoteAccOuts:0: generate DH public value request queued
ike 0:RemoteAccOuts:0: compute DH shared secret request queued
ike 0:RemoteAccOuts:0: cookie aaad59c925e55457/60eea0a873701dae
ike 0:RemoteAccOuts:0: ISAKMP SA aaad59c925e55457/60eea0a873701dae key 16:EFA920DB7F8B6F1FC34B32EA19C1353B
ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000
ike 0:RemoteAccOuts:0: sent IKE msg (agg_r1send): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae
ike 0: comes 172.x.x.x:21870->173.x.x.x:4500,ifindex=5,vrf=0....
ike 0: IKEv1 exchange=Informational id=aaad59c925e55457/60eea0a873701dae:99482542 len=92 vrf=0
ike 0: in AAAD59C925E5545760EEA0A873701DAE08100501994825420000005C21D54D2186CCB7DBEACD4AB9F0504F62F49988298A0431E29A4B44FECFE9D047A3650A4FA9C4F7B34610EC46C5166D2648C153AA63B91AD230CD96F33B983E3B
ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000
ike 0:RemoteAccOuts:0: sent IKE msg (P1_RETRANSMIT): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae
ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000
ike 0:RemoteAccOuts:0: sent IKE msg (P1_RETRANSMIT): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae
ike shrank heap by 122880 bytes
ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000
ike 0:RemoteAccOuts:0: sent IKE msg (P1_RETRANSMIT): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae
ike 0:RemoteAccOuts:0: negotiation timeout, deleting
ike 0:RemoteAccOuts: connection expiring due to phase1 down
ike 0:RemoteAccOuts: deleting
ike 0:RemoteAccOuts: deleted
172.x.x.x. is my phone ip whereas 173.x.x.x is my fortiagte wan1 ip.
For the ipsec tunnel config where is the phase-2 proposal i dont see it, want to match it with the proposals on the forticlient on my phone, i only see phase-1 proposal not phase-2 when i select the tunnel under ipsec tunnel under VPN.
Logs on fortigate as you can see only shows phase-1
I just tried connecting to the vpn from my laptop (which is on the internal network) to the Fortigate and it worked but if i connect my laptop to say nord vpn so that it can get a public ip and then connect to Fortigate then it doesn't work.
Thank You.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello kkbk96,
Thank you for using the Community Forum.
I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.
Regards,
Hello,
I have found this KB article which explain how to troubleshoot IPsec VPN tunnels:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Troubleshooting-IPsec-VPNs/ta-p/195955
Could you please tell me if it helps?
Regards,
So there is nothing wrong with the tunnel itself, it is up, I just can't get to any network, cannot ping etc when on the vpn. So I don't think this kb is going to be helpful.
Hello,
So we will continue to find a solution and we will come back to you ASAP.
Regards,
Hello @kkbk96,
Please share the IPsec VPN configuration of Fortigate and FortiClient.
Please also share the output of the following commands.
show vpn ipsec phase1-interfaceRemoteAccOuts
show vpn ipsec phase2-interface RemoteAccOuts (modify the name if needed)
diag vpn ike gateway list name RemoteAccOuts
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1502 | |
1011 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.