Hot!Weird behaviour of Dial Up IPSec

Author
sw2090
Expert Member
  • Total Posts : 1022
  • Scores: 85
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
2021/10/08 01:54:02 (permalink)
0

Weird behaviour of Dial Up IPSec

just encountered this:
 
IPSec Dial Up does allow concurrent tunnels. To make sure it can handle each one it enumerates the tunnels. Good so far.
Though the Gui (and the FOrtimanager gui also) allow you to enter too long p1 names.
If you p1 name is too long the enumerating may fail because it cannot add the number to it anymore.
In my case this worked as longs as tunnels were enumerated with just a single digit (0-9). HOwever due to reasons sometimes they get a two digit number even though there are less than 10 concurrent tunnes active.
The two digit number failed due to above reason. Then the Fortigate either doesn't let you establish a tunnel or - if it already established one successfully tends to use this one. The resulting NAT IP Change leads straight into a problem since there is two remote gws using the same dynamic tunnel now. This is then (and correctly) considered a twin connection and the SA gets deleted due to this so the tunnel goes down...
 
Just wanted to let you know...

-- 
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
#1
ede_pfau
Expert Member
  • Total Posts : 6513
  • Scores: 565
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: Weird behaviour of Dial Up IPSec 2021/10/08 05:15:24 (permalink)
0
hi,
thanks for sharing.
This behavior is well known and has not changed over the years. In fact, I tried to provoke the GUI bug by specifying a name with 14 characters (yielding 10 connections), or 15 chars, which was prohibited. Using FortiOS v6.0.13.
So apparently you cannot enter a name which would leave no space for the current connection number.
 
 
post edited by ede_pfau - 2021/10/08 05:20:00

Attached Image(s)


Ede

" Kernel panic: Aiee, killing interrupt handler!"
#2
sw2090
Expert Member
  • Total Posts : 1022
  • Scores: 85
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: Weird behaviour of Dial Up IPSec 2021/10/08 05:32:20 (permalink)
0
well I had 13 chars for p1 name and this seems to leave only space for one digit of number...

-- 
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
#3
ede_pfau
Expert Member
  • Total Posts : 6513
  • Scores: 565
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: Weird behaviour of Dial Up IPSec 2021/10/08 06:27:00 (permalink)
0
Correct (see screenshot). connection0..9, and the 11th attempt will be blocked.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#4
Toshi Esumi
Expert Member
  • Total Posts : 2733
  • Scores: 269
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: Weird behaviour of Dial Up IPSec 2021/10/08 14:21:21 (permalink)
0
So I wouldn't call it weird but limitation, which I believe from the inception of FortiGates. Not only the IPSec phase1 names (including the suffix) but also all interface names, like VLANs, are limited to 15 chars.
https://kb.fortinet.com/kb/viewContent.do?externalId=10588&sliceId=2
 
#5
sw2090
Expert Member
  • Total Posts : 1022
  • Scores: 85
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: Weird behaviour of Dial Up IPSec 2021/10/12 03:16:45 (permalink)
0
yes it is a limitation. It is just weird that the webinterface don't care about it and also that if there is an established tunnel it get screwed by the next connection attempt.
 

-- 
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
#6
Jump to:
© 2021 APG vNext Commercial Version 5.5