topic R77.30 Ipsec VPN traffic hitting Clean up rule instead of accept rule in Firewall and Security Management

R77.30 Ipsec VPN traffic hitting Clean up rule instead of accept rule

ashish_verma — Fri, 06 Dec 2019 12:13:17 GMT

Hello Mates,

I am facing this issue with IPSec VPN configured with client end Fortigate firewall. The issue is the phase1 comes up only when I initiate (ping) some traffic to the peer end IP. Even when the user connected to Checkpoint initiating the flow the gateway is not negotiating for either phase1 and/or phase2.

When client forcefully bring phase2 up (in fortigate under vpn monitor section) the phase2 also came up. But even after that the client traffic is getting dropped because of clean up rule even though an existing rule is there for this flow above clean up rule. It seems that rule is invisible for the gateway.

Also, after sometime the tunnel went down.

So to sum up:

1) Gateways not initiating Ipsec negotiation. Only after explicitly initiating the negotiation tunnel comes up.

2) Even when the tunnel is up, the traffic is getting drop by final clean up rule instead of allow rule which is above clean up rule.

Please help on this issue. Thanks.

Re: R77.30 Ipsec VPN Issue

G_W_Albrecht — Wed, 04 Dec 2019 10:10:30 GMT

Basic troubleshooting guide for such issues is sk108600: VPN Site-to-Site with 3rd party

Re: R77.30 Ipsec VPN Issue

Gaurav_Pandya — Wed, 04 Dec 2019 11:25:26 GMT

Hi Ashish,

You can do basic troubleshooting for VPN and at last you can run debug and check ike.elg file.

Are you generating ICMP traffic while testing tunnel? If so then please check setting "Accept ICMP Request" in general setting. It should be "before last".

Re: R77.30 Ipsec VPN Issue

ashish_verma — Wed, 04 Dec 2019 12:27:57 GMT

Hello Gaurav and G_W_Albrecht

Thanks for your reply. I will check the SK but what I found in ike.elg file is that after Phase2 message1, the cookies value are changed (Both init and responder) in message received by the responder as shown in "info" field in ike.elg file.