Hello,
I try in every mode to come up vpn tunnel between Fortigate with 5.2.2 and pfSense, I receive error before phase 1, with message "ignoring ike request, no policy configured" but I check 100 times... every is correct on both side. This is first time I do vpn to pfSense, I have other vpn with Cisco and Watchguard without problem, then I try change pfSense with Sophos but same result, I know that both use vpn based on openswan.
Thanks
M.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello,
"ignoring ike request, no policy configured" usually suggests firewall policy missing for Virtual IPSEC interface.
You might want to cross check firewall policies on Fortigate, there should be following two polices configured:
1>IPSEC virtual interface -> Internal interface (Where network for which traffic is to be send over VPN is connected)
2>Internal interface -> IPSEC virtual interface
Assuming VPN configured are in interface mode
On your fortigate I'm assuming interface mode, but the cfg is simple and straight-forward regardless. Just ensure you have correct policies on both sides and narrow the proposals to exact what you want.
Just be careful of your policies and the ipsec configuration & proposals.
You might get luckly on the pfSense side with; cat /var/etc/ipsec/racoon.conf your config should very similar.
# This file is automatically generated. Do not edit path pre_shared_key "/var/etc/ipsec/psk.txt"; path certificate "/var/etc/ipsec"; listen { adminsock "/var/db/racoon/racoon.sock" "root" "wheel" 0660; isakmp 1.1.1.1 [500]; isakmp_natt 1.1.1.1[4500]; } mode_cfg { auth_source external; group_source system; pool_size 253; network4 172.16.254.1; netmask4 255.255.255.0; split_network include 172.16.99.0/24; dns4 8.8.8.8; dns4 8.8.4.4; default_domain "mydomain.net"; split_dns "mydomain.net"; banner "/var/etc/ipsec/racoon.motd"; } extcfg { script "/var/etc/ipsec/ipsec.php" } remote anonymous { ph1id 1; exchange_mode aggressive; my_identifier address 1.1.1.1; peers_identifier user_fqdn "me@hyperfeed.net"; ike_frag on; generate_policy = unique; initial_contact = off; nat_traversal = on; dpd_delay = 10; dpd_maxfail = 5; support_proxy on; proposal_check obey; passive on; proposal { authentication_method xauth_psk_server; encryption_algorithm 3des; hash_algorithm md5; dh_group 2; lifetime time 28800 secs; } } sainfo anonymous { remoteid 1; encryption_algorithm 3des; authentication_algorithm hmac_sha1,hmac_md5; lifetime time 3600 secs; compression_algorithm deflate; } sainfo subnet 172.16.99.0/24 any subnet 172.16.22.0/24 any { remoteid 3; encryption_algorithm 3des; authentication_algorithm hmac_sha1; lifetime time 3600 secs; compression_algorithm deflate; } sainfo subnet 172.16.99.0/24 any subnet 172.16.20.0/24 any { remoteid 3; encryption_algorithm 3des; authentication_algorithm hmac_sha1; lifetime time 3600 secs; compression_algorithm deflate; }
PCNSE
NSE
StrongSwan
Hello,
on pfSense I haven't racoon but I have strongswan.
I check both side con, and every setting are same. I don't understand why not work.
M.
Hello,
also on my side I have pfSense 2.2, I attach config from Fortigate:
Phase 1:
edit "PF01 EGSI" set interface "port1" set keylife 14400 set mode-cfg enable set proposal 3des-sha1 set dpd disable set dhgrp 2 set remote-gw 37.59.208.193 set unity-support disable set psksecret ENC LCVkCsdFthy2N1YsRH8bcKqRfqfPXaslUE74jEIsm9I0TeJ5aQbk7i3NPQZnFE01CrtstUpXfNPhL1IJFKuv715stM6OtzVw9sK/AE5v5D9HPFTvWUtkvL8wQc+tZmE7FsnKgdJV4FrqEgCYsu+tOghCQ4JOcrXvapqnVhPq9J3VC1rdWSmVyuQaf/Cu2MwAFxFrvQ== next end
Phase 2:
edit "PF01 EGSI" set phase1name "PF01 EGSI" set proposal 3des-sha1 set pfs disable set replay disable set keepalive enable set auto-negotiate enable set keylifeseconds 8800 next end
Now I attach screen config take from web panel in pfSense:
I attach Phase 2 in other reply.
Thanks
M.
This is error I take from debug in Fortigate:
ike 0: comes 37.59.XX.XX:500->37.72.XX.XX:500,ifindex=2.... ike 0: IKEv1 exchange=Identity Protection id=d79016b120be884f/0000000000000000 len=196 ike 0: in D79016B120BE884F00000000000000000110020000000000000000C40D00003400000001000000010000002800010001000000200101000080010005800200028004000280030001800B0001800C38400D00000C09002689DFD6B7120D000014AFCAD71368A1F1C96B8696FC775701000D00001412F5F28C457168A9702D9FE274CC01000D0000184048B7D56EBCE88525E7DE7F00D6C2D3800000000D0000144A131C81070358455C5728F20E95452F0000001490CB80913EBB696E086381B5EC427B1F ike 0:d79016b120be884f/0000000000000000:1704: responder: main mode get 1st message... ike 0:d79016b120be884f/0000000000000000:1704: VID draft-ietf-ipsra-isakmp-xauth-06.txt 09002689DFD6B712 ike 0:d79016b120be884f/0000000000000000:1704: VID DPD AFCAD71368A1F1C96B8696FC77570100 ike 0:d79016b120be884f/0000000000000000:1704: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100 ike 0:d79016b120be884f/0000000000000000:1704: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D380000000 ike 0:d79016b120be884f/0000000000000000:1704: VID RFC 3947 4A131C81070358455C5728F20E95452F ike 0:d79016b120be884f/0000000000000000:1704: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F ike 0:PF01 EGSI: ignoring IKE request, no policy configured ike 0:d79016b120be884f/0000000000000000:1704: negotiation failure ike Negotiate ISAKMP SA Error: ike 0:d79016b120be884f/0000000000000000:1704: no SA proposal chosen ike 0:PF01 EGSI:PF01 EGSI: IPsec SA connect 2 37.72.XX.XX->37.59.XX.XX:0 ike 0:PF01 EGSI: ignoring request to establish IPsec SA, no policy configured ike 0: comes 37.59.XX.XX:500->37.72.XX.XX:500,ifindex=2.... ike 0: IKEv1 exchange=Identity Protection id=d79016b120be884f/0000000000000000 len=196 ike 0: in D79016B120BE884F00000000000000000110020000000000000000C40D00003400000001000000010000002800010001000000200101000080010005800200028004000280030001800B0001800C38400D00000C09002689DFD6B7120D000014AFCAD71368A1F1C96B8696FC775701000D00001412F5F28C457168A9702D9FE274CC01000D0000184048B7D56EBCE88525E7DE7F00D6C2D3800000000D0000144A131C81070358455C5728F20E95452F0000001490CB80913EBB696E086381B5EC427B1F ike 0:d79016b120be884f/0000000000000000:1705: responder: main mode get 1st message... ike 0:d79016b120be884f/0000000000000000:1705: VID draft-ietf-ipsra-isakmp-xauth-06.txt 09002689DFD6B712 ike 0:d79016b120be884f/0000000000000000:1705: VID DPD AFCAD71368A1F1C96B8696FC77570100 ike 0:d79016b120be884f/0000000000000000:1705: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100 ike 0:d79016b120be884f/0000000000000000:1705: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D380000000 ike 0:d79016b120be884f/0000000000000000:1705: VID RFC 3947 4A131C81070358455C5728F20E95452F ike 0:d79016b120be884f/0000000000000000:1705: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F ike 0:PF01 EGSI: ignoring IKE request, no policy configured ike 0:d79016b120be884f/0000000000000000:1705: negotiation failure ike Negotiate ISAKMP SA Error: ike 0:d79016b120be884f/0000000000000000:1705: no SA proposal chosen ike 0:PF01 EGSI:PF01 EGSI: IPsec SA connect 2 37.72.XX.XX->37.59.XX.XX:0 ike 0:PF01 EGSI: ignoring request to establish IPsec SA, no policy configured
Thanks
M.
Dump your openSwan and fortigate config & start some diagnostics. Also take a look at ipsec vpn tshooting.
http://socpuppet.blogspot.com/2013/10/site-2-site-routed-vpn-trouble-shooting.html
It's based on rt-based but a policy-base would be very similar minus the routes. Also what version of pfSense are you running? I thought they gotten off openswan many releases ago. I'm on 2.2 pfsense.
PCNSE
NSE
StrongSwan
Here's what you need todo;
on the phase1 at the fortigte unset and disable the following;
edit "PF01 EGSI"
set mode-cfg disable
set keylife 14400end
On phase2 you need to specify the exact local and remote subnet in the same fashion as pfsense
So apply the following
edit "PF01 EGSI" set phase1name "PF01 EGSI
set-src-addr-type subnet
set dst-addr-type subnet
set src-subnet 192.168.211.0/24 set dst-subnet 192.168.231.0/24
set keylifeseconds 8800
end
And optionally I would not run dhgrp2 but use dhgrp5 or better.
ken
PCNSE
NSE
StrongSwan
emnoc wrote:Here's what you need todo;
on the phase1 at the fortigte unset and disable the following;
edit "PF01 EGSI"
set mode-cfg disable
set keylife 14400end
On phase2 you need to specify the exact local and remote subnet in the same fashion as pfsense
So apply the following
edit "PF01 EGSI" set phase1name "PF01 EGSI
set-src-addr-type subnet
set dst-addr-type subnet
set src-subnet 192.168.211.0/24 set dst-subnet 192.168.231.0/24
set keylifeseconds 8800
end
And optionally I would not run dhgrp2 but use dhgrp5 or better.
ken
On Phase 2... I try do change you suggest, but after I do "show" and see same before....
edit "PF01 EGSI" set phase1name "PF01 EGSI" set keylifeseconds 8800 set src-subnet 192.168.211.0 255.255.255.0 set dst-subnet 192.168.231.0 255.255.255.0
Hello,
"ignoring ike request, no policy configured" usually suggests firewall policy missing for Virtual IPSEC interface.
You might want to cross check firewall policies on Fortigate, there should be following two polices configured:
1>IPSEC virtual interface -> Internal interface (Where network for which traffic is to be send over VPN is connected)
2>Internal interface -> IPSEC virtual interface
Assuming VPN configured are in interface mode
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1660 | |
1071 | |
751 | |
443 | |
219 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.