Hi, this subject might sound common to all but it's just weird where I have all settings correct but its just not working, ok here it goes.
I have a Fortigate 60D and a Sonicwall TZ100. I'm trying to set a Site-to-Site ipsec vpn and settings for both are as follows below:
Fortigate 60D Sonicewall TZ100
Firmware Version: 5.2.11 Firmware Version: 5.9.1.7-2o
SS-LOCAL-FG (192.168.x.x/24) LAN interface subnet where the Fortigate
SS-REMOTE-SW (10.5.x.x/24) ANY interface subnet where the Sonicwall
On the Fortigate, I created a New > Custom VPN Tunnel:
General Tab
Name: SS-VPN-SW Name: SS-VPN-FG
Remote gateway: 122.x.x.x IPsec Primary Gateway Name of Address: 122.49.216.42
Interface: WAN1 Auth Method: IKE using Preshared Secret
Auth Method: Pre-shared Key Shared secret: xxxxxxxx
Pre-shared Key: xxxxxxxx
IKE Version: 1 Network Tab
Mode: Main Choose local network from list: LAN Pri Subnet
Choose Destination Network: SS-REMOTE-SW
Phase 1 proposal
Algorithms: 3DES-SHA1 Proposals Tab IKE (Phase 1)
DH Group: 2 Exchange: Main Mode
Key Lifetime: 28800 DH Group: Group 2
XAUTH: none Encryption: 3DES
Authentication: SHA1
Phase 2 Life Time (secs): 28800
Name: SS-VPN-SW
Local Address: <subnet> 192.168.x.x/24 Proposals Tab Ipsec (Phase 2)
Remote Address: <subnet> 10.5.x.x/24 Protocol: ESP
Encryption: 3DES
inside Advanced Auth: SHA1
3DES-SHA1 Enable Perfect Forward Secrecy: no
Enable Replay Detection: no DH Group: 2
Enable Perfect Forward Secrecy: no Life Time (secs): 28800
local port: yes
remote port: yes Advanced
Protocol: yes Enable Keep Alive: yes
Autokey Keepalive: no
Auto-negotiate: no Access Rules created automatically by SW
Key Lifetime: 28800
Log Message
Access rules for Fortigate 60D IKE Initiator: Remote party timeout - Retransmitting IKE request
Outgoing
SS-LOCAL-FG(LAN int) > SS-REMOTE-SW (SS-VPN-SW int) Service: all
Incoming
SS-REMOTE-SW (SS-VPN-SW int) > SS-LOCAL-FG(LAN int) Service: all
Static Route
10.5.x.x/24 using SS-VPN-SW tunnel/sub int
Log Message
negotiate_error IPsec Phase 1 error
So Im not sure whats wrong with both configs.
Thanks
Jeff
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Disable NAT on the tunnel policy then try again.
You may need to do:
exec ping-options source x.x.x.x (with that being the local ip of the fortigate)
exec ping sonicwallip
Thanks for the help, both can ping to each other now.
My next objective is to be able to file share, do remote dekstop etc
Great Help there
Jeff
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1468 | |
1007 | |
748 | |
443 | |
206 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.