ThisSiteFortigate~ (root) # diag debug app ike -1 ThisSiteFortigate~ (root) # diag sniffer packet any ' host 192.168.2.10' interfaces=[any] filters=[host 192.168.2.10] 2011-06-21 22:50:52 ike 0:VPN_to_partner_p1:VPN_to_partner_p2: IPsec SA connect 9 192.168.1.1->192.168.2.10:500, natt_mode=0 2011-06-21 22:50:52 ike 0:VPN_to_partner_p1: found phase2 VPN_to_partner_p2 2011-06-21 22:50:52 ike 0:VPN_to_partner_p1: created connection: 0x1b21c58 9 192.168.1.1->192.168.2.10:500. 2011-06-21 22:50:52 ike 0:VPN_to_partner_p1: new connection. 2011-06-21 22:50:52 ike 0:VPN_to_partner_p1: IPsec SA connect 9 192.168.1.1->192.168.2.10:500 negotiating 2011-06-21 22:50:52 ike 0:VPN_to_partner_p1: no suitable ISAKMP SA, queuing quick-mode request and initiating ISAKMP SA negotiation 2011-06-21 22:50:52 ike 0:VPN_to_partner_p1:2: initiator: main mode is sending 1st message... 2011-06-21 22:50:52 ike 0:VPN_to_partner_p1:2: cookie 998befcb2be6a7a9/0000000000000000 2011-06-21 22:50:52 ike 0:VPN_to_partner_p1:2: sent IKE msg (ident_i1send): 192.168.1.1:500->192.168.2.10:500, len=228 43.584426 192.168.1.1.500 -> 192.168.2.10.500: udp 228 43.607619 192.168.2.10.500 -> 192.168.1.1.500: udp 88 43.607733 192.168.2.10.500 -> 192.168.1.1.500: udp 88 2011-06-21 22:50:54 ike 0:VPN_to_partner_p1:2: sent IKE msg (P1_RETRANSMIT): 192.168.1.1:500->192.168.2.10:500, len=228 45.570016 192.168.1.1.500 -> 192.168.2.10.500: udp 228 45.622288 192.168.2.10.500 -> 192.168.1.1.500: udp 88 45.622378 192.168.2.10.500 -> 192.168.1.1.500: udp 88 2011-06-21 22:50:55 ike shrank heap by 118784 bytes 47.632361 192.168.2.10.500 -> 192.168.1.1.500: udp 88 47.632442 192.168.2.10.500 -> 192.168.1.1.500: udp 88 2011-06-21 22:50:58 ike 0:VPN_to_partner_p1:2: sent IKE msg (P1_RETRANSMIT): 192.168.1.1:500->192.168.2.10:500, len=228 49.570815 192.168.1.1.500 -> 192.168.2.10.500: udp 228 49.642318 192.168.2.10.500 -> 192.168.1.1.500: udp 88 49.642416 192.168.2.10.500 -> 192.168.1.1.500: udp 88 51.652417 192.168.2.10.500 -> 192.168.1.1.500: udp 88 51.652527 192.168.2.10.500 -> 192.168.1.1.500: udp 88 53.662373 192.168.2.10.500 -> 192.168.1.1.500: udp 88 53.662487 192.168.2.10.500 -> 192.168.1.1.500: udp 88 55.672376 192.168.2.10.500 -> 192.168.1.1.500: udp 88 55.672468 192.168.2.10.500 -> 192.168.1.1.500: udp 88 2011-06-21 22:51:06 ike 0:VPN_to_partner_p1:2: sent IKE msg (P1_RETRANSMIT): 192.168.1.1:500->192.168.2.10:500, len=228 57.570033 192.168.1.1.500 -> 192.168.2.10.500: udp 228 59.682404 192.168.2.10.500 -> 192.168.1.1.500: udp 88 59.682513 192.168.2.10.500 -> 192.168.1.1.500: udp 88 63.692446 192.168.2.10.500 -> 192.168.1.1.500: udp 88 63.692606 192.168.2.10.500 -> 192.168.1.1.500: udp 88 67.702485 192.168.2.10.500 -> 192.168.1.1.500: udp 88 67.702583 192.168.2.10.500 -> 192.168.1.1.500: udp 88 71.712447 192.168.2.10.500 -> 192.168.1.1.500: udp 88 71.712552 192.168.2.10.500 -> 192.168.1.1.500: udp 88 2011-06-21 22:51:22 ike 0:VPN_to_partner_p1:2: sent IKE msg (P1_RETRANSMIT): 192.168.1.1:500->192.168.2.10:500, len=228 73.570072 192.168.1.1.500 -> 192.168.2.10.500: udp 228 75.722507 192.168.2.10.500 -> 192.168.1.1.500: udp 88 75.722619 192.168.2.10.500 -> 192.168.1.1.500: udp 88 2011-06-21 22:51:54 ike 0:VPN_to_partner_p1:2: 998befcb2be6a7a9/0000000000000000 negotiation of IKE SA failed due to retry timeout 2011-06-21 22:51:54 ike 0:VPN_to_partner_p1:2: expiring IKE SA 998befcb2be6a7a9/0000000000000000 2011-06-21 22:51:54 ike 0:VPN_to_partner_p1: deleting 2011-06-21 22:51:54 ike 0:VPN_to_partner_p1: flushing 2011-06-21 22:51:54 ike 0:VPN_to_partner_p1: flushed 2011-06-21 22:51:54 ike 0:VPN_to_partner_p1: deleted 2011-06-21 22:52:04 ike shrank heap by 126976 bytesAny ideas on what the problem is? I have reconfirmed all of the the configuration items (keylife, DH group, PFS, PSK). The only thing was confusion about the quickmode selector. In Checkpoint, the same thing is called encryption domains. Both are ACCEPT type ACLs that allow traffic to traverse the tunnels. I want to make sure this would cause a problem with the Phase 1, specifically because it' s a phase 2 attribute. Thanks! Matt
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1721 | |
1098 | |
752 | |
447 | |
234 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.