vpn ipsec between Fortigate 5.2.2 and pfSense

[amatteo78]

Hello,

I try in every mode to come up vpn tunnel between Fortigate with 5.2.2 and pfSense, I receive error before phase 1, with message "ignoring ike request, no policy configured" but I check 100 times... every is correct on both side. This is first time I do vpn to pfSense, I have other vpn with Cisco and Watchguard without problem, then I try change pfSense with Sophos but same result, I know that both use vpn based on openswan.

Thanks

M.

[emnoc]

On your fortigate I'm assuming   interface mode, but the cfg is simple and straight-forward regardless. Just ensure you have correct policies on  both sides and narrow the proposals to exact what you want.

Just be careful of your policies and the ipsec configuration & proposals.

You might get luckly on the pfSense side with;  cat /var/etc/ipsec/racoon.conf your config should very similar.

# This file is automatically generated. Do not edit path pre_shared_key "/var/etc/ipsec/psk.txt"; path certificate  "/var/etc/ipsec"; listen {     adminsock "/var/db/racoon/racoon.sock" "root" "wheel" 0660;     isakmp 1.1.1.1  [500];     isakmp_natt 1.1.1.1[4500]; } mode_cfg {     auth_source external;     group_source system;     pool_size 253;     network4 172.16.254.1;     netmask4 255.255.255.0;     split_network include 172.16.99.0/24;     dns4 8.8.8.8;     dns4 8.8.4.4;     default_domain "mydomain.net";     split_dns "mydomain.net";     banner "/var/etc/ipsec/racoon.motd"; } extcfg { script "/var/etc/ipsec/ipsec.php" } remote anonymous {     ph1id 1;     exchange_mode aggressive;     my_identifier address 1.1.1.1;     peers_identifier user_fqdn "me@hyperfeed.net";          ike_frag on;     generate_policy = unique;     initial_contact = off;     nat_traversal = on;               dpd_delay = 10;     dpd_maxfail = 5;     support_proxy on;     proposal_check obey;     passive on;     proposal     {         authentication_method xauth_psk_server;         encryption_algorithm 3des;         hash_algorithm md5;         dh_group 2;         lifetime time 28800 secs;     } } sainfo   anonymous {     remoteid 1;     encryption_algorithm 3des;     authentication_algorithm hmac_sha1,hmac_md5;          lifetime time 3600 secs;     compression_algorithm deflate; } sainfo subnet 172.16.99.0/24 any subnet 172.16.22.0/24 any {     remoteid 3;     encryption_algorithm 3des;     authentication_algorithm hmac_sha1;          lifetime time 3600 secs;     compression_algorithm deflate; } sainfo subnet 172.16.99.0/24 any subnet 172.16.20.0/24 any {     remoteid 3;     encryption_algorithm 3des;     authentication_algorithm hmac_sha1;          lifetime time 3600 secs;     compression_algorithm deflate; }

[amatteo78]

Hello,

on pfSense I haven't racoon but I have strongswan.

I check both side con, and every setting are same. I don't understand why not work.

M.

[amatteo78]

Hello,

also on my side I have pfSense 2.2, I attach config from Fortigate:

Phase 1:

edit "PF01 EGSI"         set interface "port1"         set keylife 14400         set mode-cfg enable         set proposal 3des-sha1         set dpd disable         set dhgrp 2         set remote-gw 37.59.208.193         set unity-support disable         set psksecret ENC LCVkCsdFthy2N1YsRH8bcKqRfqfPXaslUE74jEIsm9I0TeJ5aQbk7i3NPQZnFE01CrtstUpXfNPhL1IJFKuv715stM6OtzVw9sK/AE5v5D9HPFTvWUtkvL8wQc+tZmE7FsnKgdJV4FrqEgCYsu+tOghCQ4JOcrXvapqnVhPq9J3VC1rdWSmVyuQaf/Cu2MwAFxFrvQ==     next end

Phase 2:

edit "PF01 EGSI"         set phase1name "PF01 EGSI"         set proposal 3des-sha1         set pfs disable         set replay disable         set keepalive enable         set auto-negotiate enable         set keylifeseconds 8800     next end

Now I attach screen config take from web panel in pfSense:

  

I attach Phase 2 in other reply.

Thanks

M.

[amatteo78]

This is Phase 2:

[amatteo78]

This is error I take from debug in Fortigate:

ike 0: comes 37.59.XX.XX:500->37.72.XX.XX:500,ifindex=2.... ike 0: IKEv1 exchange=Identity Protection id=d79016b120be884f/0000000000000000 len=196 ike 0: in D79016B120BE884F00000000000000000110020000000000000000C40D00003400000001000000010000002800010001000000200101000080010005800200028004000280030001800B0001800C38400D00000C09002689DFD6B7120D000014AFCAD71368A1F1C96B8696FC775701000D00001412F5F28C457168A9702D9FE274CC01000D0000184048B7D56EBCE88525E7DE7F00D6C2D3800000000D0000144A131C81070358455C5728F20E95452F0000001490CB80913EBB696E086381B5EC427B1F ike 0:d79016b120be884f/0000000000000000:1704: responder: main mode get 1st message... ike 0:d79016b120be884f/0000000000000000:1704: VID draft-ietf-ipsra-isakmp-xauth-06.txt 09002689DFD6B712 ike 0:d79016b120be884f/0000000000000000:1704: VID DPD AFCAD71368A1F1C96B8696FC77570100 ike 0:d79016b120be884f/0000000000000000:1704: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100 ike 0:d79016b120be884f/0000000000000000:1704: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D380000000 ike 0:d79016b120be884f/0000000000000000:1704: VID RFC 3947 4A131C81070358455C5728F20E95452F ike 0:d79016b120be884f/0000000000000000:1704: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F ike 0:PF01 EGSI: ignoring IKE request, no policy configured ike 0:d79016b120be884f/0000000000000000:1704: negotiation failure ike Negotiate ISAKMP SA Error: ike 0:d79016b120be884f/0000000000000000:1704: no SA proposal chosen ike 0:PF01 EGSI:PF01 EGSI: IPsec SA connect 2 37.72.XX.XX->37.59.XX.XX:0 ike 0:PF01 EGSI: ignoring request to establish IPsec SA, no policy configured ike 0: comes 37.59.XX.XX:500->37.72.XX.XX:500,ifindex=2.... ike 0: IKEv1 exchange=Identity Protection id=d79016b120be884f/0000000000000000 len=196 ike 0: in D79016B120BE884F00000000000000000110020000000000000000C40D00003400000001000000010000002800010001000000200101000080010005800200028004000280030001800B0001800C38400D00000C09002689DFD6B7120D000014AFCAD71368A1F1C96B8696FC775701000D00001412F5F28C457168A9702D9FE274CC01000D0000184048B7D56EBCE88525E7DE7F00D6C2D3800000000D0000144A131C81070358455C5728F20E95452F0000001490CB80913EBB696E086381B5EC427B1F ike 0:d79016b120be884f/0000000000000000:1705: responder: main mode get 1st message... ike 0:d79016b120be884f/0000000000000000:1705: VID draft-ietf-ipsra-isakmp-xauth-06.txt 09002689DFD6B712 ike 0:d79016b120be884f/0000000000000000:1705: VID DPD AFCAD71368A1F1C96B8696FC77570100 ike 0:d79016b120be884f/0000000000000000:1705: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100 ike 0:d79016b120be884f/0000000000000000:1705: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D380000000 ike 0:d79016b120be884f/0000000000000000:1705: VID RFC 3947 4A131C81070358455C5728F20E95452F ike 0:d79016b120be884f/0000000000000000:1705: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F ike 0:PF01 EGSI: ignoring IKE request, no policy configured ike 0:d79016b120be884f/0000000000000000:1705: negotiation failure ike Negotiate ISAKMP SA Error: ike 0:d79016b120be884f/0000000000000000:1705: no SA proposal chosen ike 0:PF01 EGSI:PF01 EGSI: IPsec SA connect 2 37.72.XX.XX->37.59.XX.XX:0 ike 0:PF01 EGSI: ignoring request to establish IPsec SA, no policy configured

Thanks

M.

[emnoc]

Dump your openSwan and  fortigate config & start some diagnostics. Also take a look at ipsec vpn tshooting.

http://socpuppet.blogspot.com/2013/10/site-2-site-routed-vpn-trouble-shooting.html

It's based on rt-based but a policy-base would be very similar minus the routes. Also what version of pfSense are you running? I thought they gotten off openswan many releases ago. I'm on 2.2 pfsense.

[emnoc]

Here's what you need todo;

on the phase1 at the fortigte unset  and disable  the following;

edit "PF01 EGSI"

    set mode-cfg disable

    set keylife 14400end

On phase2 you need to specify the exact local and remote subnet in the same fashion as pfsense

So apply the following

edit "PF01 EGSI"         set phase1name "PF01 EGSI

        set-src-addr-type  subnet

        set dst-addr-type  subnet

        set src-subnet 192.168.211.0/24        set dst-subnet  192.168.231.0/24

        set keylifeseconds  8800

end

And optionally I would not run dhgrp2 but use dhgrp5 or better.

ken

[amatteo78]

emnoc wrote:

Here's what you need todo;

on the phase1 at the fortigte unset  and disable  the following;

edit "PF01 EGSI"

    set mode-cfg disable

    set keylife 14400end

On phase2 you need to specify the exact local and remote subnet in the same fashion as pfsense

So apply the following

edit "PF01 EGSI"        set phase1name "PF01 EGSI

        set-src-addr-type  subnet

        set dst-addr-type  subnet

        set src-subnet 192.168.211.0/24        set dst-subnet  192.168.231.0/24

        set keylifeseconds  8800

end

And optionally I would not run dhgrp2 but use dhgrp5 or better.

ken

On Phase 2... I try do change you suggest, but after I do "show" and see same before.... 

edit "PF01 EGSI"         set phase1name "PF01 EGSI"         set keylifeseconds 8800         set src-subnet 192.168.211.0 255.255.255.0         set dst-subnet 192.168.231.0 255.255.255.0

[mmishra_FTNT · Accepted solution]

Hello,

"ignoring ike request, no policy configured" usually suggests firewall policy missing for Virtual IPSEC interface.

You might want to cross check firewall policies on Fortigate, there should be following two polices configured:

1>IPSEC virtual interface -> Internal interface (Where network for which traffic is to be send over VPN is connected)

2>Internal interface -> IPSEC virtual interface

Assuming VPN configured are in interface mode