Tunnel IPSEC

[fabioloc]

Hello. I need help for a VPN Ipsec Tunnel. We have a fortigate 110c and we need to configure a tunnel ipsec with a remote endpoint, but i don' t know what kind of firewall in the remote place. The IT of the remote place send me this parameters to configure the ipsec: IPSEC PARAMETERS Encryption: 3DES Authentication method: ESP/SHA/HMAC Diffie-Helman Group: n/a Security Association Lifetime: 3600 Perfect Forward Secrecy: Yes PFS Diffie-Helman Group: 2 ISAKMP PARAMETERS Encryption: 3DES Authentication method: <the preshared key> Diffie-Helman Group: 2 Security Association Lifetime: 1800 Perfect Forward Secrecy: No PFS Diffie-Helman Group: n/a Hash algorytm: SHA I tried to configure the fortigate, but i can' t understand where to put this parameters:in the phase1 o phase2? So i tried to make a tunnel between the fortigate and a firewall Digicom in my company, a very simple firewall. But it doesn' t work, i' ve got this messagge on the fortigate log: 9 2010-11-11 11:52:15 error negotiate Negotiate SA Error: No matching gateway for new phase 1 request. 10 2010-11-11 11:51:45 notice negotiate Responder: sent 88.32.59.106 main mode message #1 (OK) 11 2010-11-11 11:51:38 notice negotiate Responder: sent 88.32.59.106 main mode message #1 (OK) 12 2010-11-11 11:51:36 notice delete_phase1_sa Deleted an ISAKMP SA on the tunnel to 88.32.59.106:500 Please help me, i' m a bit confused.. Thank you very much! Fabio

[fabioloc]

Hi. I show the configuration of the vpn that i made in the fortigate: config vpn ipsec phase1-interface edit " prova-tunnel" set interface " wan1" set local-gw xxx.yyy.zzz.qqq set dpd disable set dhgrp 2 set proposal 3des-sha1 set keylife 3600 set remote-gw aaa.bbb.ccc.ddd set psksecret ENC ae38WF0tAVbS9N0Gw2ZYGgMGENgVu3x1nECOjKDDjea9mddXWzIHwLbJMA9WM2FOC8eyNkT/Fcpn59PO6PXkt2J0 QgIKNFY+3rIkxt63JKuJF/Ks next end config vpn ipsec phase2-interface edit " prova-ph2" set pfs disable set phase1name " prova-tunnel" set proposal 3des-sha1 next end and also the debug: 0: comes aaa.bbb.ccc.ddd:500->xxx.yyy.zzz.qqq:500,ifindex=3.... 0: exchange=Identity Protection id=b648a6a874b85271/0000000000000000 len=84 0: no phase1 configuration matching aaa.bbb.ccc.ddd:500->xxx.yyy.zzz.qqq 3 0: comes aaa.bbb.ccc.ddd:500->xxx.yyy.zzz.qqq:500,ifindex=3.... 0: exchange=Identity Protection id=b648a6a874b85271/0000000000000000 len=84 0: no phase1 configuration matching aaa.bbb.ccc.ddd:500->xxx.yyy.zzz.qqq 3 Thank you again.. Fabio

[ede_pfau]

Hi, " IPSEC PARAMETERS" refer to phase 2, " ISAKMP PARAMETERS" refer to phase 1. It looks like you have mixed it up. PFS is not enabled in phase 1, but in phase 2, and the idle timeouts don' t match (which is no big deal). In addition to the parameters shown, you specify the internal subnet of the remote side in the phase 2 quick mode selectors (and of course in your policy). BTW the guy' s name is Hellman.

[fabioloc]

Thank u Ede! I will try to follow your notes. One question: Do I need to configure also a a static route? Hellman Martin Edward.. forgive me!! ;-) Fabio

[ede_pfau]

yes, you need a static route to the remote network, with interface=your_tunnel. And a policy granting access from internal to the tunnel interface.