FortiGate IPSec VPN User Guide - FirewallShop.com

Monitoring and testing VPNs
VPN troubleshooting tips
2005-03-31 15:38:29 log_id=0101023004 type=event subtype=ipsec pri=notice vd=root
loc_ip=172.16.62.10 loc_port=500 rem_ip=172.16.62.11 rem_port=500 out_if=port2
vpn_tunnel=asdf cookies=151c3a5c6dd93c54/5ed26a81fb7a2d0c action=negotiate init=local
mode=quick stage=1 dir=outbound status=success msg="Initiator: sent 172.16.62.11 quick
mode message #1 (OK)"
2005-03-31 15:38:29 log_id=0101023006 type=event subtype=ipsec pri=notice vd=root
loc_ip=172.16.62.10 loc_port=500 rem_ip=172.16.62.11 rem_port=500 out_if=port2
vpn_tunnel=asdf cookies=151c3a5c6dd93c54/5ed26a81fb7a2d0c action=install_sa
in_spi=66867f2b out_spi=e22de275 msg="Initiator: tunnel 172.16.62.10/172.16.62.11
install ipsec sa"
2005-03-31 15:38:29 log_id=0101023004 type=event subtype=ipsec pri=notice vd=root
loc_ip=172.16.62.10 loc_port=500 rem_ip=172.16.62.11 rem_port=500 out_if=port2
vpn_tunnel=asdf cookies=151c3a5c6dd93c54/5ed26a81fb7a2d0c action=negotiate init=local
mode=quick stage=2 dir=outbound status=success msg="Initiator: sent 172.16.62.11 quick
mode message #2 (DONE)"
2005-03-31 15:38:29 log_id=0101023002 type=event subtype=ipsec pri=notice vd=root
loc_ip=172.16.62.10 loc_port=500 rem_ip=172.16.62.11 rem_port=500 out_if=port2
vpn_tunnel=asdf cookies=151c3a5c6dd93c54/5ed26a81fb7a2d0c action=negotiate
status=success msg="Initiator: tunnel 172.16.62.11, transform=ESP_3DES, HMAC_SHA1"
Entries similar to the following indicate that phase 1 negotiations broke down
because the preshared keys belonging to the VPN peers were not identical. A
tunnel was not established.
2005-03-31 16:06:39 log_id=0101023003 type=event subtype=ipsec pri=error vd=root
loc_ip=192.168.70.2 loc_port=500 rem_ip=192.168.80.2 rem_port=500 out_if=port2
vpn_tunnel=s cookies=3896343ae575f210/0a7ba199149e31e9 action=negotiate
status=negotiate_error msg="Negotiate SA Error: probable pre-shared secret mismatch"
For more information about how to interpret error log messages, see the FortiGate
Log Message Reference.
VPN troubleshooting tips
Most connection failures are due to a configuration mismatch between the
FortiGate unit and the remote peer. In general, begin troubleshooting an IPSec
VPN connection failure as follows:
1 Ping the remote network or client to verify whether the connection is up. See
“Testing VPN connections” on page 157.
2 Verify the configuration of the FortiGate unit and the remote peer. Check the
following IPSec parameters:
• The mode setting for ID protection (main or aggressive) on both VPN peers
must be identical.
• The authentication method (preshared keys or certificates) used by the client
must be supported on the FortiGate unit and configured properly.
• If preshared keys are being used for authentication purposes, both VPN peers
must have identical preshared keys.
• The remote client must have at least one set of phase 1 encryption,
authentication, and Diffie-Hellman settings that match corresponding settings
on the FortiGate unit.
• Both VPN peers must have the same NAT traversal setting (enabled or
disabled).
• The remote client must have at least one set of phase 2 encryption and
authentication algorithm settings that match the corresponding settings on the
FortiGate unit.
• If you are using manual keys to establish a tunnel, the Remote SPI setting on
the FortiGate unit must be identical to the Local SPI setting on the remote
peer, and vise versa.
FortiGate IPSec VPN Version 3.0 User Guide
01-30005-0065-20070716 159