Hot!IPsec VPN tunnel down

Author
rbrahmi
New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/04/10 06:00:16
  • Status: offline
2020/10/23 04:24:02 (permalink)
0

IPsec VPN tunnel down

Hello,
 
I am trying to set up a VPN tunnel between a fortigate and palo alto firewall on the remote site,
the fortigate is connected behind a juniper which is used to net the private address on the exterior interface of the fortigate and then we have a peplik which overcomes the public addresses with port redirects
All VPN tunnels are connected except one tunnel
Below are the logs generated by fortigate when I debug
 
ike 0:BKAM-DC:784401: out C2FE6E0C9FC42BEA00000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000
ike 0:BKAM-DC:784401: sent IKE msg (P1_RETRANSMIT): 192.168.10.2:500->105.73.83.17:500, len=288, id=c2fe6e0c9fc42bea/0000000000000000
ike 0:BKAM-DC:784401: negotiation timeout, deleting
ike 0:BKAM-DC: connection expiring due to phase1 down
ike 0:BKAM-DC: deleting
ike 0:BKAM-DC: deleted
ike 0:BKAM-DC: schedule auto-negotiate
ike 0:BKAM-DC:784403: initiator: main mode is sending 1st message...
ike 0:BKAM-DC:784403: cookie d03c7f08585f989f/0000000000000000
ike 0:BKAM-DC:784403: out D03C7F08585F989F00000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000
ike 0:BKAM-DC:784403: sent IKE msg (ident_i1send): 192.168.10.2:500->105.73.83.17:500, len=288, id=d03c7f08585f989f/0000000000000000
ike 0:BKAM-DC:784403: out D03C7F08585F989F00000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000
ike 0:BKAM-DC:784403: sent IKE msg (P1_RETRANSMIT): 192.168.10.2:500->105.73.83.17:500, len=288, id=d03c7f08585f989f/0000000000000000
ike shrank heap by 159744 bytes
ike 0:BKAM-DC:784403: out D03C7F08585F989F00000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000
ike 0:BKAM-DC:784403: sent IKE msg (P1_RETRANSMIT): 192.168.10.2:500->105.73.83.17:500, len=288, id=d03c7f08585f989f/0000000000000000
ike 0:BKAM-DC:784403: out D03C7F08585F989F00000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000
ike 0:BKAM-DC:784403: sent IKE msg (P1_RETRANSMIT): 192.168.10.2:500->105.73.83.17:500, len=288, id=d03c7f08585f989f/0000000000000000
ike 0:BKAM-DC:784403: negotiation timeout, deleting
ike 0:BKAM-DC: connection expiring due to phase1 down
ike 0:BKAM-DC: deleting
ike 0:BKAM-DC: deleted
ike 0:BKAM-DC: schedule auto-negotiate
ike 0:BKAM-DC:784405: initiator: main mode is sending 1st message...
ike 0:BKAM-DC:784405: cookie 8001bc2bad1fee27/0000000000000000
ike 0:BKAM-DC:784405: out 8001BC2BAD1FEE2700000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000
ike 0:BKAM-DC:784405: sent IKE msg (ident_i1send): 192.168.10.2:500->105.73.83.17:500, len=288, id=8001bc2bad1fee27/0000000000000000
ike 0:BKAM-DC:784405: out 8001BC2BAD1FEE2700000000000000000110020000000000000001200D00003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E01008003000180020004800400140D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310CA6F2C179D9215529D560D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00001416F6CA16E4A4066D83821A0F0AEAA8620D0000144485152D18B6BBCD0BE8A8469579DDCC0D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000
ike 0:BKAM-DC:784405: sent IKE msg (P1_RETRANSMIT): 192.168.10.2:500->105.73.83.17:500, len=288, id=8001bc2bad1fee27/0000000000000000
diag2020-10-23 12:05:38.934056 ike shrank heap by 159744 bytes
 
Any help please
 
Ragrds
#1

5 Replies Related Threads

    mauromosc
    New Member
    • Total Posts : 13
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/10/20 01:53:13
    • Status: offline
    Re: IPsec VPN tunnel down 2020/10/23 05:20:01 (permalink)
    0
    Hi, Radouane,
     
    Stupid question, but I have to ask you: did you enable NAT-T? Is this Juniper a router or a firewall? Does it have a rule allowing this traffic or is it NATing it? 
    From the logs you can see that there is no response from the other peer, it would interesting to you debug the Palo Alto to see if it receives any thing from your FortiGate.
     
    Good luck,
    Mauro.
    #2
    rbrahmi
    New Member
    • Total Posts : 9
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/04/10 06:00:16
    • Status: offline
    Re: IPsec VPN tunnel down 2020/10/23 07:56:44 (permalink)
    0
    Hi,
     
    Can you tell me why this is a stupid question please?
    Isn't this a forum for discussing issues like mine ?
    If you think this is a stupid question, don't answer please
     
    Regards
    #3
    mauromosc
    New Member
    • Total Posts : 13
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/10/20 01:53:13
    • Status: offline
    Re: IPsec VPN tunnel down 2020/10/23 08:06:08 (permalink)
    0
    Hi, Radouane,
     
    I'm sorry, I wasn't clear about my text. My question was stupid. :)  Also count to 10 before texting and read again:
     
    Stupid question, but I have to ask you
     
    And your concern is completely valid and add value to the discussions here.
     
    Regards,
    Mauro Mosczynski
    post edited by mauromosc - 2020/10/23 08:09:15
    #4
    rbrahmi
    New Member
    • Total Posts : 9
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/04/10 06:00:16
    • Status: offline
    Re: IPsec VPN tunnel down 2020/10/23 09:30:35 (permalink)
    0
    Hi Mauro, 
     
    I'm sorry too, I did not understand very well
    The issue has been resolved, it was coming from the remote site on the palo alto firewall
    now the tunnel is up
    thank you very much for your precious help
     
    Regards
    #5
    mendocino
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/11/04 06:53:46
    • Status: offline
    Re: IPsec VPN tunnel down 2020/11/04 07:06:06 (permalink)
    0

    Hello, how are you? You were able to solve the problem, since I have a similar problem
    #6
    Jump to:
    © 2020 APG vNext Commercial Version 5.5