site to site vpn tunnel is up but no traffic flowing

[fortinoy]

setup site to site vpn using the ipsec wizard. tunnel is already up but keeps on getting the error "progress ipsec phase 1 negotiate failure" in vpn events log. need your help where and what to check.

note: i initially setup ssl vpn on the same fortigate and it works well. trying to setup the site to site vpn now. the setup on the ipsec wizard is easy and fast. but it is not working.

please advise. thanks.

[fortinoy]

regarding the sdwan setup for ipsec, our setup shows only 1 tunnel interface which is under wan1 on the remote fortigate. the config on the KB shows 2 separate tunnels. both local and remote fortigates are in production. i'm not sure how to create two separate tunnel interfaces for one site to site vpn. sorry i'm really new at this.

i tried adding sdwan rules this time, but same issue. tunnel is up, no traffic coming into the tunnel.

Here is a screen shot of the policy from local to remote LAN via from LAN to TUNNEL

Here is the policy from remote to local LAN from TUNNEL to LAN

Here is the screenshot of the static route:

i can provide more screenshots if you need me to. thanks for all your help. really appreciate it.

[fortinoy]

regarding the config on the KB, it has 2 tunnel interfaces. our setup only has 1 tunnel interface. sdwan was only used for the default route for the internet. the tunnel was still bind under wan 1. i tried adding sd wan rules for the internet and access to the lan traffic but same issue.

i will try to post pics here of our setup.

attach here is our static route

[fortinoy]

looks like i can only attach one pic at a time.

here is the policy from remote to local LAN

[fortinoy]

UPDATE:

from the remote fortigate CLI, i can ping the server behind the local fortigate. however, i cannot ping the pc behind the remote fortigate from the CLI of local fortigate.

if i ping the server behind the local fortigate using a pc behind the remote fortigate, it fails. i also cannot ping a pc from the remote fortigate using the server behind the local fortigate.

Here is the latest debug on the remote fortigate:

FG100ETK18010728 $ ike 0:REMOTE  VLAN NAME:REMOTE  VLAN NAME:2: admin flush IPsec SA

ike 0:REMOTE  VLAN NAME: flushing REMOTE  VLAN NAME

ike 0:REMOTE  VLAN NAME: deleting IPsec SA with SPI 0c21a003

ike 0:REMOTE  VLAN NAME:REMOTE  VLAN NAME: deleted IPsec SA with SPI 0c21a003, SA count: 0

ike 0:REMOTE  VLAN NAME: sending SNMP tunnel DOWN trap for REMOTE  VLAN NAME

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:703: sending delete for IPsec SA SPI dec858ab

ike 0:REMOTE  VLAN NAME:610:704: send informational

ike 0:REMOTE  VLAN NAME:610: sent IKE msg (INFORMATIONAL): REMOTE  WAN IP:500->LOCAL  WAN IP:500, len=80, id=8483ff7338bdefcc/77459347bf53a36f:00000003

ike 0:REMOTE  VLAN NAME:REMOTE  VLAN NAME: sending SNMP tunnel DOWN trap

ike 0:REMOTE  VLAN NAME: deleting IPsec SA with SPI 0c21a003

ike 0:REMOTE  VLAN NAME: flushed REMOTE  VLAN NAME

ike 0: comes LOCAL  WAN IP:500->REMOTE  WAN IP:500,ifindex=7....

ike 0: IKEv2 exchange=INFORMATIONAL_RESPONSE id=8483ff7338bdefcc/77459347bf53a36f:00000003 len=80

ike 0:REMOTE  VLAN NAME:610: received informational response

ike 0:REMOTE  VLAN NAME:610:704: processing informational acknowledgement

ike 0:REMOTE  VLAN NAME:610: processing delete ack (proto 3)

ike 0:REMOTE  VLAN NAME: deleting IPsec SA with SPI 0c21a003

ike 0:REMOTE  VLAN NAME:REMOTE  VLAN NAME: IPsec SA connect 7 REMOTE  WAN IP->LOCAL  WAN IP:0

ike 0:REMOTE  VLAN NAME:REMOTE  VLAN NAME: using existing connection

ike 0:REMOTE  VLAN NAME:REMOTE  VLAN NAME: config found

ike 0:REMOTE  VLAN NAME:REMOTE  VLAN NAME: IPsec SA connect 7 REMOTE  WAN IP->LOCAL  WAN IP:500 negotiating

ike 0:REMOTE  VLAN NAME:610:705 initiating CREATE_CHILD exchange

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: PFS enabled

ike 0:REMOTE  VLAN NAME:610: sent IKE msg (CREATE_CHILD): REMOTE  WAN IP:500->LOCAL  WAN IP:500, len=480, id=8483ff7338bdefcc/77459347bf53a36f:00000004

ike 0: comes LOCAL  WAN IP:500->REMOTE  WAN IP:500,ifindex=7....

ike 0: IKEv2 exchange=CREATE_CHILD_RESPONSE id=8483ff7338bdefcc/77459347bf53a36f:00000004 len=464

ike 0:REMOTE  VLAN NAME:610: received create-child response

ike 0:REMOTE  VLAN NAME:610: initiator received CREATE_CHILD msg

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: found child SA SPI dec858ac state=3

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: PFS enabled, group=14

ike 0:REMOTE  VLAN NAME:610:705: peer proposal:

ike 0:REMOTE  VLAN NAME:610:705: TSr_0 0:0.0.0.0-255.255.255.255:0

ike 0:REMOTE  VLAN NAME:610:705: TSi_0 0:0.0.0.0-255.255.255.255:0

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: comparing selectors

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: matched by rfc-rule-2

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: phase2 matched by subset

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: accepted proposal:

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: TSr_0 0:0.0.0.0-255.255.255.255:0

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: TSi_0 0:0.0.0.0-255.255.255.255:0

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: autokey

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: incoming child SA proposal:

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: proposal id = 1:

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:   protocol = ESP:

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:      encapsulation = TUNNEL

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=ENCR, val=AES_CBC (key_len = 256)

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=INTEGR, val=SHA256

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=DH_GROUP, val=MODP2048

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=ESN, val=NO

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: matched proposal id 1

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: proposal id = 1:

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:   protocol = ESP:

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:      encapsulation = TUNNEL

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=ENCR, val=AES_CBC (key_len = 256)

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=INTEGR, val=SHA256

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=DH_GROUP, val=MODP2048

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705:         type=ESN, val=NO

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: lifetime=28800

ike 0:REMOTE  VLAN NAME: schedule auto-negotiate

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: replay protection enabled

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: set sa life soft seconds=28500.

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: set sa life hard seconds=28800.

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: IPsec SA selectors #src=1 #dst=1

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: src 0 7 0:0.0.0.0-255.255.255.255:0

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: dst 0 7 0:0.0.0.0-255.255.255.255:0

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: add IPsec SA: SPIs=dec858ac/0c21a004

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: added IPsec SA: SPIs=dec858ac/0c21a004

ike 0:REMOTE  VLAN NAME:610:REMOTE  VLAN NAME:705: sending SNMP tunnel UP trap

ike shrank heap by 126976 bytes

ike 0:REMOTE  VLAN NAME: link is idle 7 REMOTE  WAN IP->LOCAL  WAN IP:0 dpd=2 seqno=57

ike 0:REMOTE  VLAN NAME:610: send IKEv2 DPD probe

ike 0:REMOTE  VLAN NAME:706: sending NOTIFY msg

ike 0:REMOTE  VLAN NAME:610:706: send informational

ike 0:REMOTE  VLAN NAME:610: sent IKE msg (INFORMATIONAL): REMOTE  WAN IP:500->LOCAL  WAN IP:500, len=80, id=8483ff7338bdefcc/77459347bf53a36f:00000005

ike 0: comes LOCAL  WAN IP:500->REMOTE  WAN IP:500,ifindex=7....

ike 0: IKEv2 exchange=INFORMATIONAL_RESPONSE id=8483ff7338bdefcc/77459347bf53a36f:00000005 len=80

ike 0:REMOTE  VLAN NAME:610: received informational response

ike 0:REMOTE  VLAN NAME:706: received NOTIFY acknowledgement

ike 0:REMOTE  VLAN NAME:610:706: processing informational acknowledgement

ike 0: comes LOCAL  WAN IP:500->REMOTE  WAN IP:500,ifindex=7....

ike 0: IKEv2 exchange=INFORMATIONAL id=8483ff7338bdefcc/77459347bf53a36f:00000004 len=80

ike 0:REMOTE  VLAN NAME:610: received informational request

ike 0:REMOTE  VLAN NAME:610: sent IKE msg (INFORMATIONAL_RESPONSE): REMOTE  WAN IP:500->LOCAL  WAN IP:500, len=80, id=8483ff7338bdefcc/77459347bf53a36f:00000004

 Hope you guys will continue to help me check. Thanks.

[sistemasRCR]

I got the same problem, could you solve it?