IKEv2 IPSec Troubleshooting Tips needed on FortiOS 7.2.8

[mhaneke]

Hello,

in a transition from another manufacturers router to Fortigate I have to transpose IKEv2 Dial-In Client configurations into FortiOS 7.2.8. Although the necessary parameters should match. The connections do not work. Therefore I tried to troubleshoot the IKE connections with the following CLI commands:

diagnose debug application ike -1

diagnose vpn ike log-filter src-addr4 <remote WAN-IP>

alternatively: diagnose vpn ike log-filter dst-addr4 <local WAN-IP>

diagnose debug console timestamp enable
diagnose debug enable

But there are only empty lines. I double-checked that the dial-up client could reach the Fortigate and successfully pcap´ed.

Although I am new to FortiOS I would bet that there is a debug command to have a live view / monitor the setup negotiations of IKE phase 1 and IPSec phase 2 connections. But I have no clue how start these. Your hints would be appreciated.

The Admin-Guide https://docs.fortinet.com/document/fortigate/7.2.8/administration-guide/834425/understanding-vpn-rel... "Understanding VPN related Logs" mentions these logs, but I don´t know where to find them.

Any suggestions?

Here is a sample IKEv2 configuration. The NCP VPN software client f. Windows is used with it.

config vpn ipsec phase1-interface

edit "SAMPLE"
set type dynamic
set interface "port10"
set ike-version 2
set peertype one
set net-device disable
set mode-cfg enable
set proposal aes256-sha256
set dpd on-idle
set dhgrp 14
set peerid "xy@xyz.com"
set assign-ip-from dhcp
set dns-mode auto
set ipv4-split-include "INTRANET Subnet"
set psksecret ENC <Encrypted PSK>
set dpd-retryinterval 60

config vpn ipsec phase2-interface
edit "SAMPLE"
set phase1name "SAMPLE"
set proposal aes256-sha256
set dhgrp 14
next

[mpeddalla · Accepted solution]

Hello  @mhaneke ,

Thank you for contacting the Fortinet Forum portal.

Please use the below commands:

# diagnose debug disable 
# diagnose vpn ike log-filter dst-addr4 [remote-peer]          (public IP of user PC which you're trying to connect-remote-peer ip)
# diagnose debug console timestamp enable
# diagnose debug application ike -1
# diagnose debug enable

# diagnose debug  disable            ==========to stop debugs

-Your commands are correct but the IP address is wrong.

Best regards,

Manasa.

If you feel the above steps helped to resolve the issue mark the reply as solved so that other customers can get it easily while searching on similar scenarios.

[mpeddalla · Accepted solution]

Hello  @mhaneke ,

No problem.

Did the new command work, have you tested them?

Best regards,

Manasa.

If you feel the above steps helped resolve the issue, mark the reply as solved so that other customers can get it easily while searching for similar scenarios.

[mpeddalla · Accepted solution]

Hello  @mhaneke ,

Thank you for contacting the Fortinet Forum portal.

Please use the below commands:

# diagnose debug disable 
# diagnose vpn ike log-filter dst-addr4 [remote-peer]          (public IP of user PC which you're trying to connect-remote-peer ip)
# diagnose debug console timestamp enable
# diagnose debug application ike -1
# diagnose debug enable

# diagnose debug  disable            ==========to stop debugs

-Your commands are correct but the IP address is wrong.

Best regards,

Manasa.

If you feel the above steps helped to resolve the issue mark the reply as solved so that other customers can get it easily while searching on similar scenarios.

[mhaneke]

Hello @manasa 

thank You for Your quick and helpful answer.

I got it wrong. I inserted the WAN-IP of the Fortigate in

# diagnose vpn ike log-filterdst-addr4 [remote-peer] 

best regards

Martin Haneke

[mpeddalla · Accepted solution]

Hello  @mhaneke ,

No problem.

Did the new command work, have you tested them?

Best regards,

Manasa.

If you feel the above steps helped resolve the issue, mark the reply as solved so that other customers can get it easily while searching for similar scenarios.

[ede_pfau · Accepted solution]

Just as an additional hint:

if the VPN doesn't come up completely, it could be

1- that either the policy or the route to the remote network are missing

or

2- the DHCP server is not set to "type ipsec".

If the VPN comes up but traffic is not flowing, check the session setup with

"diag deb flow"

Get the params for setting up filters, output etc. from a KB article.

[mhaneke]

Hello@ede_pfau 

You were right. The policy rulesets were missing, therefore the clients could not access the network, although the phase 2 SA and TSi were up and set correctly.

And the second error was, that I did not know that mode ike-cfg does not work together with DHCP and You have to choose an "Address Group" instead.

best regards

Martin Haneke