Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 28 subscribers
  • Views 1035 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Impossible to peer XG 135 with fortigate 100e

SimonIT

Hi,

 

I have to create a peer with a partner.

My device is : XG135 (SFOS 17.5.8 MR-8)

Peer device is : Fortigate 100E

We tried with differents configuration (ikev1 and 2) and i have still the same issue in logs : 

2019-11-04 17:48:23 09[NET] <6336> received packet: from 41.250.215.65[500] to 192.168.65.254[500] (292 bytes)
2019-11-04 17:48:23 09[ENC] <6336> parsed ID_PROT request 0 [ SA V V V V V V V V V V ]
2019-11-04 17:48:23 09[CFG] <6336> looking for an ike config for 192.168.65.254...41.250.215.65
2019-11-04 17:48:23 09[CFG] <6336> candidate: 192.168.65.254...cloud.singla.ma, prio 3100
2019-11-04 17:48:23 09[CFG] <6336> found matching ike config: 192.168.65.254...cloud.singla.ma with prio 3100
2019-11-04 17:48:23 09[IKE] <6336> received NAT-T (RFC 3947) vendor ID
2019-11-04 17:48:23 09[IKE] <6336> received draft-ietf-ipsec-nat-t-ike-03 vendor ID
2019-11-04 17:48:23 09[IKE] <6336> received draft-ietf-ipsec-nat-t-ike-02 vendor ID
2019-11-04 17:48:23 09[IKE] <6336> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
2019-11-04 17:48:23 09[ENC] <6336> received unknown vendor ID: 16:f6:ca:16:e4:a4:06:6d:83:82:1a:0f:0a:ea:a8:62
2019-11-04 17:48:23 09[IKE] <6336> received draft-ietf-ipsec-nat-t-ike-00 vendor ID
2019-11-04 17:48:23 09[IKE] <6336> received DPD vendor ID
2019-11-04 17:48:23 09[IKE] <6336> received FRAGMENTATION vendor ID
2019-11-04 17:48:23 09[IKE] <6336> received FRAGMENTATION vendor ID
2019-11-04 17:48:23 09[ENC] <6336> received unknown vendor ID: 82:99:03:17:57:a3:60:82:c6:a6:21:de:00:00:00:00
2019-11-04 17:48:23 09[IKE] <6336> 41.250.215.65 is initiating a Main Mode IKE_SA
2019-11-04 17:48:23 09[IKE] <6336> IKE_SA (unnamed)[6336] state change: CREATED => CONNECTING
2019-11-04 17:48:23 09[CFG] <6336> selecting proposal:
2019-11-04 17:48:23 09[CFG] <6336> proposal matches
2019-11-04 17:48:23 09[CFG] <6336> received proposals: IKE:AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048
2019-11-04 17:48:23 09[CFG] <6336> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048, IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_AES128_CMAC/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CURVE_25519/MODP_3072/MODP_4096/MODP_8192/MODP_2048, IKE:AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_AES128_CMAC/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CURVE_25519/MODP_3072/MODP_4096/MODP_8192/MODP_2048
2019-11-04 17:48:23 09[CFG] <6336> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048
2019-11-04 17:48:23 09[IKE] <6336> sending XAuth vendor ID
2019-11-04 17:48:23 09[IKE] <6336> sending DPD vendor ID
2019-11-04 17:48:23 09[IKE] <6336> sending Cisco Unity vendor ID
2019-11-04 17:48:23 09[IKE] <6336> sending FRAGMENTATION vendor ID
2019-11-04 17:48:23 09[IKE] <6336> sending NAT-T (RFC 3947) vendor ID
2019-11-04 17:48:23 09[ENC] <6336> generating ID_PROT response 0 [ SA V V V V V ]
2019-11-04 17:48:23 09[NET] <6336> sending packet: from 192.168.65.254[500] to 41.250.215.65[500] (184 bytes)
2019-11-04 17:48:23 04[NET] sending packet: from 192.168.65.254[500] to 41.250.215.65[500]
2019-11-04 17:48:23 03[NET] received packet: from 41.250.215.65[500] to 192.168.65.254[500] on Wan
2019-11-04 17:48:23 03[NET] waiting for data on sockets
2019-11-04 17:48:23 16[NET] <6336> received packet: from 41.250.215.65[500] to 192.168.65.254[500] (460 bytes)
2019-11-04 17:48:23 16[ENC] <6336> parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
2019-11-04 17:48:23 16[IKE] <6336> local host is behind NAT, sending keep alives
2019-11-04 17:48:23 16[IKE] <6336> remote host is behind NAT
2019-11-04 17:48:23 16[CFG] <6336> candidate "VPN_Maroc-1", match: 1/1/3100 (me/other/ike)
2019-11-04 17:48:23 16[ENC] <6336> generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
2019-11-04 17:48:23 16[NET] <6336> sending packet: from 192.168.65.254[500] to 41.250.215.65[500] (460 bytes)
2019-11-04 17:48:23 04[NET] sending packet: from 192.168.65.254[500] to 41.250.215.65[500]
2019-11-04 17:48:23 03[NET] received packet: from 41.250.215.65[4500] to 192.168.65.254[4500] on Wan
2019-11-04 17:48:23 03[NET] waiting for data on sockets
2019-11-04 17:48:23 30[NET] <6336> received packet: from 41.250.215.65[4500] to 192.168.65.254[4500] (140 bytes)
2019-11-04 17:48:23 30[ENC] <6336> parsed ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
2019-11-04 17:48:23 30[CFG] <6336> looking for pre-shared key peer configs matching 192.168.65.254...41.250.215.65[192.168.200.2]
2019-11-04 17:48:23 30[IKE] <6336> no peer config found
2019-11-04 17:48:23 30[IKE] <6336> queueing INFORMATIONAL task
2019-11-04 17:48:23 30[IKE] <6336> activating new tasks
2019-11-04 17:48:23 30[IKE] <6336> activating INFORMATIONAL task
2019-11-04 17:48:23 30[ENC] <6336> generating INFORMATIONAL_V1 request 3994324338 [ HASH N(AUTH_FAILED) ]
2019-11-04 17:48:23 30[NET] <6336> sending packet: from 192.168.65.254[4500] to 41.250.215.65[4500] (140 bytes)
2019-11-04 17:48:23 30[IKE] <6336> IKE_SA (unnamed)[6336] state change: CONNECTING => DESTROYING
2019-11-04 17:48:23 04[NET] sending packet: from 192.168.65.254[4500] to 41.250.215.65[4500]
2019-11-04 17:48:26 03[NET] received packet: from 41.250.215.65[4500] to 192.168.65.254[4500] on Wan
2019-11-04 17:48:26 03[NET] waiting for data on sockets
2019-11-04 17:48:26 24[DMN] [GARNER-LOGGING] (child_alert) ALERT: received IKE message with invalid SPI (69BB8E6F) from other side
2019-11-04 17:48:32 03[NET] received packet: from 41.250.215.65[4500] to 192.168.65.254[4500] on Wan
2019-11-04 17:48:32 03[NET] waiting for data on sockets
2019-11-04 17:48:32 20[DMN] [GARNER-LOGGING] (child_alert) ALERT: received IKE message with invalid SPI (69BB8E6F) from other side

 

We tried with differents PSK so it's not the cause of this issue...

 

Thank you for your help.

 

 



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    first of all I'd set defined encryption parameters on both sides.

    I think the problem is that the device that receives all the connection is not able to identify the different "calling" devices. There is some point wher you can define a string that is unigue to the connection (e.g Mailadresse).

Reply
  • 0

    Hi,

    first of all I'd set defined encryption parameters on both sides.

    I think the problem is that the device that receives all the connection is not able to identify the different "calling" devices. There is some point wher you can define a string that is unigue to the connection (e.g Mailadresse).

Children