So i use this firewall for my homelab and tried to establish ipsec remote vpn from my phone to the fortigate but it stops at phase 1, i looked at the logs but cant make out whats wrong:
Logs below:
ike 0: comes 172.x.x.x:26655->173.x.x.x:500,ifindex=5,vrf=0....
ike 0: IKEv1 exchange=Aggressive id=aaad59c925e55457/0000000000000000 len=572 vrf=0
ike 0: in AAAD59C925E55457000000000000000001100400000000000000023C0400009C000000010000000100000090010100040300002401010000800B0001800C708080010007800E00808003000180020002800400050300002402010000800B0001800C708080010007800E00808003000180020001800400050300002003010000800B0001800C7080800100058003000180020002800400050000002004010000800B0001800C7080800100058003000180020001800400050A0000C40411150C4FDE77C7991600F89A104FB26D1C628FA46398683E32BFAD3070AF3340D665B465372E86C7AFF0F85D555A14B0E686DCFA45F8F314106DB76E41461030BE808BDE15AF3B62F0E47BFE504C96A030432EB60918E2005CE0F50B74D3DDC7F39E689F690331EF5B0284CD9DF4CC6665B43D648938E4B62CD74E98AD36B0C9CFE444431A9D33BDEA628A36B6353B5DBEEE25606D0E7F3222AA1E7DA5DB9AAB9B17E8894BED24C73DF9D9DA75845B25A86BB9333EB6C1C56E45E2E647DE2B05000014B1DC84B7341BE3A5F078B6439A913A3E0D00000C011105DCC00000020D0000144A131C81070358455C5728F20E95452F0D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D0000144485152D18B6BBCD0BE8A8469579DDCC0D00001412F5F28C457168A9702D9FE274CC01000D000014AFCAD71368A1F1C96B8696FC775701000D0000144C53427B6D465D1B337BB755A37A7FEF00000014B4F01CA951E9DA8D0BAFBBD34AD3044E
ike 0:aaad59c925e55457/0000000000000000:0: responder: aggressive mode get 1st message...
ike 0:aaad59c925e55457/0000000000000000:0: VID RFC 3947 4A131C81070358455C5728F20E95452F
ike 0:aaad59c925e55457/0000000000000000:0: VID draft-ietf-ipsec-nat-t-ike-02 CD60464335DF21F87CFDB2FC68B6A448
ike 0:aaad59c925e55457/0000000000000000:0: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F
ike 0:aaad59c925e55457/0000000000000000:0: VID draft-ietf-ipsec-nat-t-ike-00 4485152D18B6BBCD0BE8A8469579DDCC
ike 0:aaad59c925e55457/0000000000000000:0: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100
ike 0:aaad59c925e55457/0000000000000000:0: VID DPD AFCAD71368A1F1C96B8696FC77570100
ike 0:aaad59c925e55457/0000000000000000:0: VID forticlient connect license 4C53427B6D465D1B337BB755A37A7FEF
ike 0:aaad59c925e55457/0000000000000000:0: VID Fortinet Endpoint Control B4F01CA951E9DA8D0BAFBBD34AD3044E
ike 0::0: peer identifier IPV4_ADDR 192.0.0.2
ike 0: cache rebuild start
ike 0:RemoteAccOuts: cached as dynamic
ike 0: cache rebuild done
ike 0: IKEv1 Aggressive, comes 172.x.x.x:26655->173.x.x.x 5
ike 0:aaad59c925e55457/0000000000000000:0: negotiation result
ike 0:aaad59c925e55457/0000000000000000:0: proposal id = 1:
ike 0:aaad59c925e55457/0000000000000000:0: protocol id = ISAKMP:
ike 0:aaad59c925e55457/0000000000000000:0: trans_id = KEY_IKE.
ike 0:aaad59c925e55457/0000000000000000:0: encapsulation = IKE/none
ike 0:aaad59c925e55457/0000000000000000:0: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128
ike 0:aaad59c925e55457/0000000000000000:0: type=OAKLEY_HASH_ALG, val=SHA.
ike 0:aaad59c925e55457/0000000000000000:0: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:aaad59c925e55457/0000000000000000:0: type=OAKLEY_GROUP, val=MODP1536.
ike 0:aaad59c925e55457/0000000000000000:0: ISAKMP SA lifetime=86400
ike 0:aaad59c925e55457/0000000000000000:0: SA proposal chosen, matched gateway RemoteAccOuts
ike 0:RemoteAccOuts: created connection: 0x7631148 5 173.x.x.x->172.x.x.x:26655.
ike 0:RemoteAccOuts:0: DPD negotiated
ike 0:RemoteAccOuts:0: peer supports UNITY
ike 0:RemoteAccOuts:0: enable FortiClient license check
ike 0:RemoteAccOuts:0: enable FortiClient endpoint compliance check, use 169.254.1.1
ike 0:RemoteAccOuts:0: selected NAT-T version: RFC 3947
ike 0:RemoteAccOuts:0: generate DH public value request queued
ike 0:RemoteAccOuts:0: compute DH shared secret request queued
ike 0:RemoteAccOuts:0: cookie aaad59c925e55457/60eea0a873701dae
ike 0:RemoteAccOuts:0: ISAKMP SA aaad59c925e55457/60eea0a873701dae key 16:EFA920DB7F8B6F1FC34B32EA19C1353B
ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000
ike 0:RemoteAccOuts:0: sent IKE msg (agg_r1send): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae
ike 0: comes 172.x.x.x:21870->173.x.x.x:4500,ifindex=5,vrf=0....
ike 0: IKEv1 exchange=Informational id=aaad59c925e55457/60eea0a873701dae:99482542 len=92 vrf=0
ike 0: in AAAD59C925E5545760EEA0A873701DAE08100501994825420000005C21D54D2186CCB7DBEACD4AB9F0504F62F49988298A0431E29A4B44FECFE9D047A3650A4FA9C4F7B34610EC46C5166D2648C153AA63B91AD230CD96F33B983E3B
ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000
ike 0:RemoteAccOuts:0: sent IKE msg (P1_RETRANSMIT): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae
ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000
ike 0:RemoteAccOuts:0: sent IKE msg (P1_RETRANSMIT): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae
ike shrank heap by 122880 bytes
ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000
ike 0:RemoteAccOuts:0: sent IKE msg (P1_RETRANSMIT): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae
ike 0:RemoteAccOuts:0: negotiation timeout, deleting
ike 0:RemoteAccOuts: connection expiring due to phase1 down
ike 0:RemoteAccOuts: deleting
ike 0:RemoteAccOuts: deleted
172.x.x.x is my phone ip whereas 173.x.x.x is my wan1 ip on fortigate.
Also in the pic above where is phase 2 proposal? i cannot see it, want to make sure it matches what's on the FortiClient on my phone.
Logs on fortigate gui:
As you can it only shows phase-1 success, no phase-2s anywhere.
Let me know if i need to upload more pics and i will gladly do so.
Thank You.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi,
Can you please share the output for the below command from CLI
#sh vpn ipsec phase1-interface RemoteAccOut
Thanks and Regards,
Patterson
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1692 | |
1087 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.