remote address does not match configuration address

[kenneth_li]

Hi ,

I meet a issue that site to site VPN between Cisco router and fortigate. The VPN is not work and I enable debug in fortigate . I saw the error " remote address 218.207.163.181 does not match configuration address 112.5.54.2, drop" .

IP 112.5.54.2 is Cisco route public IP.

IP 218.207.163.181 is not whthin both configuration.

There is no related VIP config in fortigate about 218.207.163.181.

Whether anyone intercept the packet and pretend the router and try to negotiate with me ?

Best Regards

Kenneth

[rwpatterson]

I have seen this where a remote host is trying to negotiate a tunnel with your firewall. This happened to me when I broke a tunnel down (after we stopped working with a vendor) but they didn't break the tunnel config down on their side. This is merely a nuisance, since your FGT will not use that stream to set up a tunnel.

[omega]

kenneth_li wrote:

" remote address 218.207.163.181 does not match configuration address 112.5.54.2, drop" .

IP 112.5.54.2 is Cisco route public IP.

IP 218.207.163.181 is not whthin both configuration.

There is no related VIP config in fortigate about 218.207.163.181.

You should look for that address on the side. Most likely the Cisco has multiple Adresses.

Since both Ips you mentioned are in the same ASN I don't think that someone else tries to negotiate a tunnel.

[kenneth_li]

Hi Omega,

Thanks for you guys reply , But now the problem is I can not negotiate a tunnel with Cisco router because of the error .. It seems like FTG drop the tunnel negotiate session because remote IP is not same as configuration. I have checked cisco router interface address and could not found others adresses . Of course , I'll double check the router config.

On the other hand , the router build vpn tunnel with another FTG is fine. Two FTG VPN config is just the same. So I don't think router has multiple adresses