Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

peer has not completed Configuration Method

Hey volks, I have two Fortigate 50B in use, one on the Datacenter with a static IP, the other with dynamic ip (using DDNS on a branch office. The VPN tunnel between these both fortigates works fine. The Client Login with FortiClient on the Datacenter works fine The Client Login on the branch office doesn' t work. I setup the client user on both fortigates exactly the same way, however, when i try to login with the client on the branch office it stops on Phase1 Here is some stuff from the test log (client side) In run_timer_list, jiffies=00000000, skipped = 0 tvecs[1]->bits is 3, tvecs->index is 0 sys_get_local_gwy() called: [in] remote gw: [in] Next hop: sys_get_local_gwy() called: [in] remote gw: [in] Next hop: Detect local gateway for peer: sys_get_local_gwy() called: [in] remote gw: [in] Next hop: sys_get_local_gwy() called: [in] remote gw: [in] Next hop: Get sa_connect message...>, natt_mode=0 Using new connection...natt_mode=0 Set connection name = test. Adding timer #1... expiry=3600, data=7373512 Adding to bucket 3 at index 1 Tunnel --->,natt_en=1 is starting negotiation Will negotiate a normal SA Initiator: main mode is sending 1st message... Sending DPD VID payloads.... Sending VID payload.... Sending NATT VID payload (draft3).... Sending NATT VID payload (draft3 and draft1).... Initiator: sent main mode message #1 (OK) Adding timer #2... expiry=28770, data=8446856 Adding to bucket 4 at index 1 set retransmit: st=1, timeout=10. Adding timer #2... expiry=10, data=8446856 Adding to bucket 1 at index 10 Next_time = 10 sec In run_timer_list, jiffies=0000000A, skipped = 10 tvecs[1]->bits is 3, tvecs->index is 0 No response from the peer, retransmit (st=1).... set retransmit: st=1, timeout=5. Adding timer #2... expiry=5, data=8446856 Adding to queue Adding timer #3... expiry=5, data=8446856 Adding to bucket 1 at index 15 Next_time = 5 sec And here is some stuff from debug on the fortigate: ike 0:cl-morczak:9: protocol id = ISAKMP: ike 0:cl-morczak:9: trans_id = KEY_IKE. ike 0:cl-morczak:9: encapsulation = IKE/none ike 0:cl-morczak:9: type=OAKLEY_ENCRYPT_ALG, val=3DES_CBC. ike 0:cl-morczak:9: type=OAKLEY_HASH_ALG, val=SHA. ike 0:cl-morczak:9: type=AUTH_METHOD, val=PRESHARED_KEY. ike 0:cl-morczak:9: type=OAKLEY_GROUP, val=1024. ike 0:cl-morczak:9: ISKAMP SA lifetime=28800 ike 0:cl-morczak:9: selected NAT-T version: draft-ietf-ipsec-nat-t-ike-03 ike 0:cl-morczak:9: cookie 4a1d904ab3796906/c8797af4df630401 ike 0:cl-morczak:9: ISAKMP SA 4a1d904ab3796906/c8797af4df630401 key 24:7E9B3A40BB67191989653F2A519B8F283842E35F32FB3552 ike 0:cl-morczak:9: out 4A1D904AB3796906C8797AF4DF63040101100400000000000000017804000034000000010000000100000028010100010000002001010000800B0001800C7080800100058002000280030001800400020A0000843B7CBE3DCB7E060769B314488CA9FE1B6443E4EA420B13589108971695A6E25FA3DD7B86B3DAEB8464242CC5175045F9EA25684A827C04DC9F216683367FFD3235F05C28ACD0430C8F3446294975CF845BE239ED10BD31B039B14C931543B5144E2D4F8E9F626A7B8BAB4B32D8E2FC953911BAAC5D8448927C15212D1F59F31D05000014896F966D3BCAF449D5574709975D69B80800000C01000000B21BD9E80D0000188EDBBF9DA7EB800C3E50E3374CBC721145E00C07820000147D9419A65310CA6F2C179D9215529D5682000018A45DCF64A65F5777D0C46C11952F12330C4F0EDD0D000018D9E0F562FA1F210A0A25097917ACEACB042F3EF30D000014AFCAD71368A1F1C96B8696FC77570100000000148299031757A36082C6A621DE000401CA ike 0:cl-morczak:9: sent IKE msg (agg_r1send):>, len=376, id=4a1d904ab3796906/c8797af4df630401 ike 0: comes>,ifindex=6.... ike 0: IKEv1 exchange=Aggressive id=4a1d904ab3796906/c8797af4df630401 len=132 ike 0: in 4A1D904AB3796906C8797AF4DF6304018210040100000000000000845B117D2275091654ECD2B1FC09A010EA990EB1AF3DD6B822427CD7EF200C6E8BB6092E5F4EF848C2A86A5039476EC0F3EC9DE9CBC73C35F220587EB4661CBF0F94B159EEADE8C0052E11FB8B35378BA3F7FBB2CC42C0275059BF3073331BCDE5E9AA3541DAD19E15 ike 0:cl-morczak:9: responder: aggressive mode get 2nd response... ike 0:cl-morczak:9: dec 4A1D904AB3796906C8797AF4DF63040182100401000000000000008482000018F0D3809D32C94EEA66604972C54BC26C71AD1D2308000018733B05382518ED27B3B563955F26E2E9E3FC070C0B00001804628B67EB9945AA6F027531E12774739A5710E10000001C00000001011060024A1D904AB3796906C8797AF4DF63040100000000 ike 0:cl-morczak:9: received NAT-D payload type 130 ike 0:cl-morczak:9: received NAT-D payload type 130 ike 0:cl-morczak:9: received notify type 24578 ike 0:cl-morczak:9: PSK authentication succeeded ike 0:cl-morczak:9: authentication OK ike 0:cl-morczak:9: NAT detected: ME PEER ike 0:cl-morczak:9: port change 500 -> 32808 ike 0:cl-morczak:9: established IKE SA 4a1d904ab3796906/c8797af4df630401 ike 0:cl-morczak: adding new dynamic tunnel for ike 0:cl-morczak_0: added new dynamic tunnel for ike 0:cl-morczak_0:9: processing INITIAL-CONTACT ike 0:cl-morczak_0: flushing ike 0:cl-morczak_0: flushed ike 0:cl-morczak_0:9: processed INITIAL-CONTACT ike 0:cl-morczak_0:9: no pending Quick-Mode negotiations ike 0: comes>,ifindex=6.... ike 0: IKEv1 exchange=Quick id=4a1d904ab3796906/c8797af4df630401:8f8f4bd4 len=148 ike 0: in 4A1D904AB3796906C8797AF4DF630401081020018F8F4BD400000094A29C3620F5A828A842E5EBE0405A278FD6735D4B271D89863879793CA87C04EC54146E5F8B6090856C87EB8929DF8FE0323720A8D3E4B605BAC0CF8A9329721643DAF9D5D5EB15020310031DA2D44A27774C61863B97D0BA42AF07DCAD34EDD8F0697B11F2088C5B361EC3346F49A2DA82C9D41829B46369 ike 0:cl-morczak_0:9: peer has not completed Configuration Method diag debug appli ike 255ike shrank heap by 126976 bytes ike 0: comes>,ifindex=6.... ike 0: IKEv1 exchange=Informational id=d3aae11c2d6532bd/8bbff19b7a6bd2dd:8ed84767 len=92 What means the " peer has not completed Configuration Method" on the fortigate side? Why do i get a " No response from the peer, retransmit (st=1)...." on the test log on client side? Any suggestions are welcome.... Greetz, Matthias
New Contributor

nobody ever had this issue? Can' t believe .... :(
New Contributor

Hey Volks, I found the solution, don' t ask me why it was enabled (must be a default setting as i never activate it via CLI) the set mode-cfg was enabled. And because my FortiClient (4.1.3) does not support this feature the Phase1 was dropped all the time... To fix it i did the following steps: open the cli on the fortigate config vpn ipsec phase1-interface edit " NAME-OF-THE-CLIENT-PROFILE" set mode-cfg disable next end After this i was able to connect to the fortigate without any problems. greetz, Matthias
Valued Contributor

Hi morczak, the mode-cfg issue you have is a bug in the early firmware versions of MR3, i think it was fixed somewhere aroung MR3 Patch 2-3. Check the release notes, in some situations it was turned on by default.

FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C

"a bug in the early firmware versions of MR3".. ? What does MR3 stand for?


I'm running version FGT50E-5.6.6-FW-build1630-180913, and that bug seems to be in that version. There's apparently no newer version than that (don't want to go to v6 just yet).


Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors