site to site vpn fortigate and cisco router

[#1]

hi everyone, i' m setting up a site to site vpn between a fortigate and a cisco router, on my cisco router i' m using dyndns to update it' s public ip address, for the fortigate i have an static ip address well i configured both the fortigate and the cisco router as stated in a fortinet guide on configuring site to site vpn between cisco and forti (FortiGate Antivirus Firewall to Cisco Router IPSec VPN Interoperability Technical Note), but my vpn inst working, i ran some debug on cisco (debug crypto isa) and this is the output ------------------------------------------------------------------------ *Nov 17 22:39:46.596: ISAKMP:(1001):purging node 1936815858 *Nov 17 22:39:47.844: ISAKMP (0:1001): received packet from 189.210.125.54 dport 500 sport 500 Global (R) QM_IDLE *Nov 17 22:39:47.844: ISAKMP: set new node -2128679275 to QM_IDLE *Nov 17 22:39:47.844: ISAKMP:(1001): processing HASH payload. message ID = -2128679275 *Nov 17 22:39:47.844: ISAKMP:(1001): processing NOTIFY DPD/R_U_THERE protocol 1 spi 0, message ID = -2128679275, sa = 49EEC508 *Nov 17 22:39:47.848: ISAKMP:(1001):deleting node -2128679275 error FALSE reason " Informational (in) state 1" *Nov 17 22:39:47.848: ISAKMP:(1001):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY *Nov 17 22:39:47.848: ISAKMP:(1001):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE *Nov 17 22:39:47.848: ISAKMP:(1001):DPD/R_U_THERE received from peer 189.210.125.54, sequence 0x96 *Nov 17 22:39:47.848: ISAKMP: set new node -588365181 to QM_IDLE *Nov 17 22:39:47.848: ISAKMP:(1001):Sending NOTIFY DPD/R_U_THERE_ACK protocol 1 spi 1223058832, message ID = -588365181 *Nov 17 22:39:47.848: ISAKMP:(1001): seq. no 0x96 *Nov 17 22:39:47.848: ISAKMP:(1001): sending packet to 189.210.125.54 my_port 500 peer_port 500 (R) QM_IDLE *Nov 17 22:39:47.848: ISAKMP:(1001):Sending an IKE IPv4 Packet. *Nov 17 22:39:47.848: ISAKMP:(1001):purging node -588365181 *Nov 17 22:39:47.852: ISAKMP:(1001):Input = IKE_MESG_FROM_PEER, IKE_MESG_KEEP_ALIVE *Nov 17 22:39:47.852: ISAKMP:(1001):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE *Nov 17 22:39:51.688: ISAKMP:(1001):purging node -880549832 *Nov 17 22:39:52.952: ISAKMP (0:1001): received packet from 189.210.125.54 dport 500 sport 500 Global (R) QM_IDLE *Nov 17 22:39:52.952: ISAKMP: set new node 932589724 to QM_IDLE *Nov 17 22:39:52.952: ISAKMP:(1001): processing HASH payload. message ID = 932589724 *Nov 17 22:39:52.952: ISAKMP:(1001): processing NOTIFY DPD/R_U_THERE protocol 1 spi 0, message ID = 932589724, sa = 49EEC508 *Nov 17 22:39:52.952: ISAKMP:(1001):deleting node 932589724 error FALSE reason " Informational (in) state 1" *Nov 17 22:39:52.952: ISAKMP:(1001):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY *Nov 17 22:39:52.952: ISAKMP:(1001):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE -------------------------------------------------------------------------------------------- let me know if you need some more info on my configurations thanks in advance

[rwpatterson]

Being that this is a 40net forum, let' s have the output of the FGT. Also a couple of questions:

Do you have a policy in place? No tunnel traffic without one.

What are the P1 and P2 definitions? From the CLI:

 show vpn ipsec phase1[-interface] <tunnel P1 name> (if interface mode tunnel)
 show vpn ipsec phase2[-interface] <tunnel P2 name> (if interface mode tunnel)

If interface mode is used, do you have a corresponding static route in place? From reading the Cisco output, it looks to me that your phase 2 doesn' t match. Check the quick mode selectors on the FGT as well as the DH group (if used).

[#3]

Hi rwpatterson, thanks for your answer regarding your questions 1) Yes, i have policy from my internal interface to my external interface action:encrypt, vpn tunnel:my vpn tunnel, allow inbound enable, allow outbound enable, 2) here is the output of the show commands -------------------------------- sh vpn ipsec phase1 VPN-gpoATI config vpn ipsec phase1 edit " VPN-gpoATI" set type ddns set interface " wan1" set dpd disable set proposal 3des-sha1 set mode aggressive set remotegw-ddns " example.dyndns.org" set psksecret ENC AADnA0h9Zff5Vhfkm13kJ3H8XwvkwP4oTaguRXj7wL2VZNC8mbFw9zqPqyhjWG0xrUuNkN4KfMoStR6w8z/ZnYBYkzxpyfRjFaM2MFFOgec1ZvCG next end ------------------------------- sh vpn ipsec phase2 VPN-ATI config vpn ipsec phase2 edit " VPN-ATI" set keepalive enable set phase1name " VPN-gpoATI" set proposal 3des-sha1 set dhgrp 1 set dst-subnet 192.168.1.0 255.255.255.0 set src-subnet 192.168.2.0 255.255.255.0 next end -------------------------------- 3) I' m not using interface mode 4) I going to put my cisco vpn configuration just in case someone knows about cisco too --------------------------------- crypto isakmp policy 10 encr 3des authentication pre-share group 5 crypto isakmp key 123456 address xx.xx.xx.xx ! crypto ipsec transform-set ESP_3DES_SHA esp-3des esp-sha-hmac ! crypto map VPN 10 ipsec-isakmp set peer xx.xx.xx.xx set transform-set ESP_3DES_SHA match address 101 ! ! ! interface Dialer0 crypto map VPN ! ------------------------------------------ I hope this helps, and thanks for your answers Regards

[rwpatterson]

What is the firmware version on the Fortigate? Also does ACL 101 match your phase 2 quick-mode selectors?

[#5]

hi rwpatterson, firmware version v4.0 mr1 patch 5 and yes, my acl 101 is like this access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 thanks for your answer

[emnoc]

For the starts I see the following things wrong 1: why are you using aggressive mode? 2: fgt has difflehellman group 1 cisco has group 5 3: cisco policy looks wrong as far as what version of authentication hash md5 vrs sha1 I would do the following; rebuilt the FGT to use mainmode and dh-group2 or 5 on the cisco identify a sha1 e,g crypto isakmp policy 1 hash sha authentication pre-share encr 3des group 5 Then execute a clear both ike sa and then see what happens.

[#7]

thanks for your answers emnoc and rwpatterson, I have solved this issue, i changed from aggressive to main mode and changed diffie-hellman group on fgt, also i noted that my nat translation was a little bit off, when i modified my nat translation on the cisco router it worked perfectly fine. as emnoc said i was already using authentication hash sha1 it just seems that this is the default so it is not showed on the show run output if someone else wants the configs regarding the vpn just ask and i' ll post it for reference thanks

[emnoc]

I think on the cisco, if you don' t specify it, md5 hash would be the default under the isakmp policy. I always specify it or specify both if you might be presented with both during the initial policy. I kinda never rely on the defaults when configuring VPNs to non-Fortinet devices . btw aggressive is normally used for vpn-remote-clients and considered less secured and prone for DoS attacks, where as mainmode is more suited and secured. I never seen the former used on site2sites vpns.

[#9]

Well about the agressive mode, that was just for testing ' cause main mode wasn' t working either, and I don' t have much knowledge about VPNs Anyways, thanks for your help I' ve already solved this issue. Regards