Scribd
Upload
124 views7 pages

FortiGate VPN Debugging Guide

The document contains log output from a FortiGate firewall regarding IPsec VPN connectivity. It shows: 1) The firewall configuring debug logs to monitor IPsec IKE negotiations with an IP address 61.14.7.148. 2) An IPsec tunnel establishment attempt is initiated but fails to agree on an encryption proposal between the endpoints. 3) Further IPsec connection attempts are made but continue to fail establishing an encrypted tunnel.

Uploaded by

javed.rafik.1
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
124 views7 pages

FortiGate VPN Debugging Guide

The document contains log output from a FortiGate firewall regarding IPsec VPN connectivity. It shows: 1) The firewall configuring debug logs to monitor IPsec IKE negotiations with an IP address 61.14.7.148. 2) An IPsec tunnel establishment attempt is initiated but fails to agree on an encryption proposal between the endpoints. 3) Further IPsec connection attempts are made but continue to fail establishing an encrypted tunnel.

Uploaded by

javed.rafik.1
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 7

FortiGate-2601F # config vdom

FortiGate-2601F (vdom) # edit vsys3


current vf=vsys3:2

FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) # diag vpn ike log-filter dst-addr4 61.14.7.148

FortiGate-2601F (vsys3) # diag debug application ike -1


Debug messages will be on for 13 minutes.

FortiGate-2601F (vsys3) # diag deb enable

FortiGate-2601F (vsys3) # ike 2:Japan_ODC:Japan_ODC: IPsec SA connect 9


192.8.202.121->61.14.7.148:0
ike 2:Japan_ODC:Japan_ODC: using existing connection
ike 2:Japan_ODC:Japan_ODC: traffic triggered, serial=1 17:10.115.90.15:36031-
>17:10.122.28.136:161
ike 2:Japan_ODC:Japan_ODC: config found
ike 2:Japan_ODC: request is on the queue
ike 2: comes 61.14.7.148:500->192.8.202.121:500,ifindex=9,vrf=0....
ike 2: IKEv2 exchange=INFORMATIONAL id=ccd4fdab6a42dd31/34e797fd7453e4bb:00000ae1
len=80
ike 2: in
CCD4FDAB6A42DD3134E797FD7453E4BB2E20250000000AE10000005000000034793828D8F78F446CFAA
C2442D5C9DE1D0FBDF74A335DD5260F0B1EAFF4C533CE
CC8CDA8E415E173041CB6AD86C12510D
ike 2:Japan_ODC: HA state master(2)
ike 2:Japan_ODC:1689768: dec
CCD4FDAB6A42DD3134E797FD7453E4BB2E20250000000AE10000002000000004
ike 2:Japan_ODC:1689768: received informational request
ike 2:Japan_ODC:1689768: enc 0F0E0D0C0B0A0908070605040302010F
ike 2:Japan_ODC:1689768: out
CCD4FDAB6A42DD3134E797FD7453E4BB2E20252800000AE1000000500000003427045AF39D87E711EB1
A2D440FE774D698BBF3B5D0700
7CDF50DFF25D279937813FCDABC417838DBDE1F227BDF1B3BBE
ike 2:Japan_ODC:1689768: sent IKE msg (INFORMATIONAL_RESPONSE): 192.8.202.121:500-
>61.14.7.148:500, len=80, vrf=0, id=ccd4fdab6a42dd31/34e
797fd7453e4bb:00000ae1
ike 2: comes 61.14.7.148:500->192.8.202.121:500,ifindex=9,vrf=0....
ike 2: IKEv2 exchange=CREATE_CHILD id=ccd4fdab6a42dd31/34e797fd7453e4bb:00000ae2
len=400
ike 2: in
CCD4FDAB6A42DD3134E797FD7453E4BB2E20240000000AE20000019029000174FBB0A36F4C5906A5379
DC4BDB940ADA078E3AF2F4941273693FB648D7A335773
717B80236AFAA46519343DBDC4C3713CCE9965768F6BE95EDFBD587BB0A0B600B04D86D8785FC4F10FE
45E36B045B100B5EC356A62F525729587A192BD67D974DD1A260E01
332D41D272A13005ADA40FD7FC4FB2DEAF71798848EB495A4B2240E559C7F0158A163A2DCA8C7AB9CFD
E22E6EB3EC4DCEDFD472EEB0BB87F5A62D6BEE13FCB535D5F6C7A65
60C7DC58ED30A3CD9B54EC9BFE2C7009AC92C657DE20D18B2FCFE10496433ED4081E68235AE6F26529B
5E0F52A3424C1FDFD45C62A950707DF386E1F7EC7AC226C1CCD3E3E
A4103B7FDCB37F42B297DA95AA048165DBC8DDADAB5CA6C2BBEDF77D112649BE26D6F904A527D185CF1
7728AD2494FF354AA4B8E4E9D6D70FE84822779C9C38EAE4082D8FB
11C37A703A53B466D9FB1CE781A8685F4A36B2B1CF8C9462A92A2E345D4160EA469233AB32E968982AF
39B667A4664CC398D38A54FA35A10FC978BED
ike 2:Japan_ODC: HA state master(2)
ike 2:Japan_ODC:1689768: dec
CCD4FDAB6A42DD3134E797FD7453E4BB2E20240000000AE20000016829000004210000080000400A280
000340000003001030404FE587
3ED0300000C0100000C800E0100030000080300000C0300000804000014000000080500000022000024
244B6047B86E4363DE3CCADD0053FE9CA9CD8B2CC50B8274553D763
A65D8CDB62C0000680014000050435C13E5480B82B05DE96F701D7CB7F081FE9B8D43C73B7A898210D9
7030FC5345EB9A7BF6DB52879663623A38F9105E7B4165741F2113D
8B668F91D14C3E017CCCDDFCD361A933D302077EAFEAF082AC78CC493EAA6C4F8AB61EF492757022D00
004002000000070000100000FFFF00000000FFFFFFFF08000028000
0FFFF00000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000040020000
00070000100000FFFF00000000FFFFFFFF080000280000FFFF00000
000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
ike 2:Japan_ODC:1689768: received create-child request
ike 2:Japan_ODC:1689768: responder received CREATE_CHILD exchange
ike 2:Japan_ODC:1689768: processing notify type ESP_TFC_PADDING_NOT_SUPPORTED
ike 2:Japan_ODC:1689768: responder creating new child
ike 2:Japan_ODC:1689768:57512: peer proposal:
ike 2:Japan_ODC:1689768:57512: TSi_0 0:0.0.0.0-255.255.255.255:0
ike 2:Japan_ODC:1689768:57512: TSi_1 0:::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:0
ike 2:Japan_ODC:1689768:57512: TSr_0 0:0.0.0.0-255.255.255.255:0
ike 2:Japan_ODC:1689768:57512: TSr_1 0:::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:0
ike 2:Japan_ODC:1689768:Japan_ODC:57512: comparing selectors
ike 2:Japan_ODC:1689768:Japan_ODC:57512: matched by rfc-rule-3
ike 2:Japan_ODC:1689768:Japan_ODC:57512: phase2 matched by subset
ike 2:Japan_ODC:1689768:Japan_ODC:57512: accepted proposal:
ike 2:Japan_ODC:1689768:Japan_ODC:57512: TSi_0 0:0.0.0.0-255.255.255.255:0
ike 2:Japan_ODC:1689768:Japan_ODC:57512: TSr_0 0:0.0.0.0-255.255.255.255:0
ike 2:Japan_ODC:1689768:Japan_ODC:57512: autokey
ike 2:Japan_ODC:1689768:Japan_ODC:57512: incoming child SA proposal:
ike 2:Japan_ODC:1689768:Japan_ODC:57512: proposal id = 1:
ike 2:Japan_ODC:1689768:Japan_ODC:57512: protocol = ESP:
ike 2:Japan_ODC:1689768:Japan_ODC:57512: encapsulation = TUNNEL
ike 2:Japan_ODC:1689768:Japan_ODC:57512: type=ENCR, val=AES_CBC (key_len =
256)
ike 2:Japan_ODC:1689768:Japan_ODC:57512: type=INTEGR, val=SHA256
ike 2:Japan_ODC:1689768:Japan_ODC:57512: type=DH_GROUP, val=ECP384
ike 2:Japan_ODC:1689768:Japan_ODC:57512: type=ESN, val=NO
ike 2:Japan_ODC:1689768:Japan_ODC:57512: my proposal:
ike 2:Japan_ODC:1689768:Japan_ODC:57512: proposal id = 1:
ike 2:Japan_ODC:1689768:Japan_ODC:57512: protocol = ESP:
ike 2:Japan_ODC:1689768:Japan_ODC:57512: encapsulation = TUNNEL
ike 2:Japan_ODC:1689768:Japan_ODC:57512: type=ENCR, val=AES_CBC (key_len =
256)
ike 2:Japan_ODC:1689768:Japan_ODC:57512: type=INTEGR, val=SHA256
ike 2:Japan_ODC:1689768:Japan_ODC:57512: type=DH_GROUP, val=MODP1536
ike 2:Japan_ODC:1689768:Japan_ODC:57512: type=ESN, val=NO
ike 2:Japan_ODC:1689768:Japan_ODC:57512: lifetime=3600
ike 2:Japan_ODC:1689768:Japan_ODC:57512: no proposal chosen
ike Negotiate SA Error: ike ike [1481]
ike 2:Japan_ODC:1689768:Japan_ODC:57512: responder preparing CREATE_CHILD message
ike 2:Japan_ODC:1689768: enc 000000080000000E0706050403020107
ike 2:Japan_ODC:1689768: out
CCD4FDAB6A42DD3134E797FD7453E4BB2E20242800000AE2000000502900003424743FF2E596428A130
847EE0982490C71D0FF9DB3F9A
A1A86DB88D429536C139DBD495C85B1498C633843654FEF423C
ike 2:Japan_ODC:1689768: sent IKE msg (CREATE_CHILD_RESPONSE): 192.8.202.121:500-
>61.14.7.148:500, len=80, vrf=0, id=ccd4fdab6a42dd31/34e7
97fd7453e4bb:00000ae2
ike 2:Japan_ODC:1689768:57512: no proposal chosen
ike 2:Japan_ODC:Japan_ODC: IPsec SA connect 9 192.8.202.121->61.14.7.148:0
ike 2:Japan_ODC:Japan_ODC: using existing connection
ike 2:Japan_ODC:Japan_ODC: traffic triggered, serial=1 17:10.115.90.15:47171-
>17:10.115.93.244:161
ike 2:Japan_ODC:Japan_ODC: config found
ike 2:Japan_ODC: request is on the queue
ike 2:Japan_ODC:Japan_ODC: IPsec SA connect 9 192.8.202.121->61.14.7.148:0
ike 2:Japan_ODC:Japan_ODC: using existing connection
ike 2:Japan_ODC:Japan_ODC: config found
ike 2:Japan_ODC: request is on the queue
ike 2:Japan_ODC:Japan_ODC: IPsec SA connect 9 192.8.202.121->61.14.7.148:0
ike 2:Japan_ODC:Japan_ODC: using existing connection
ike 2:Japan_ODC:Japan_ODC: traffic triggered, serial=1 17:10.115.90.15:48011-
>17:10.115.93.244:161
ike 2:Japan_ODC:Japan_ODC: config found
ike 2:Japan_ODC: request is on the queue
ike 2: comes 61.14.7.148:500->192.8.202.121:500,ifindex=9,vrf=0....
ike 2: IKEv2 exchange=INFORMATIONAL id=ccd4fdab6a42dd31/34e797fd7453e4bb:00000ae3
len=80
ike 2: in
CCD4FDAB6A42DD3134E797FD7453E4BB2E20250000000AE300000050000000343CAB3B022642325DF3D
4886FF901070363B97335CA5A715E626D7F1909943B11
61AF98F17E3F52674EE1DFF5E132FDEB
ike 2:Japan_ODC: HA state master(2)
ike 2:Japan_ODC:1689768: dec
CCD4FDAB6A42DD3134E797FD7453E4BB2E20250000000AE30000002000000004
ike 2:Japan_ODC:1689768: received informational request
ike 2:Japan_ODC:1689768: enc 0F0E0D0C0B0A0908070605040302010F
ike 2:Japan_ODC:1689768: out
CCD4FDAB6A42DD3134E797FD7453E4BB2E20252800000AE3000000500000003413B177C35D66CC6D011
9A7EF857C969B6166D8DDD6350
5633BA5A7C62543E6C76D626B947F5BAB770E231C872D3646CB
ike 2:Japan_ODC:1689768: sent IKE msg (INFORMATIONAL_RESPONSE): 192.8.202.121:500-
>61.14.7.148:500, len=80, vrf=0, id=ccd4fdab6a42dd31/34e
797fd7453e4bb:00000ae3
ike 2: comes 61.14.7.148:500->192.8.202.121:500,ifindex=9,vrf=0....
ike 2: IKEv2 exchange=CREATE_CHILD id=ccd4fdab6a42dd31/34e797fd7453e4bb:00000ae4
len=400
ike 2: in
CCD4FDAB6A42DD3134E797FD7453E4BB2E20240000000AE4000001902900017441FC139EFA27472330C
CDF4390C397EE82AC9F9F0663F423B2DF346070C900BF
2D461D1CA8793E86F3D46CE0CAE55D564B7341DD52E2C11F32F55A0F3FB70893DB7D3EBB4C198C89420
B9471734D675A84E15BA5812960FF32C9F84144E047FD1870F5A0EA
5B0A8165310C8A46C5DF3F6BA906984362C87C45A35CAA77080057D096344DF012BD450477B852A2823
639ABB276920ADC3D2321613866DF367D7D24CD2EEE6CB2D4ED6F59
E566E82649A87D7BFC195598CB258A0D4D73D779DC6921F843041368E6C76EC69110BB85FF418097F04
6BA9C7D6111B4F534F041C184EFD22F7B90CF1BBBF280D5C330A85A
8FB3A37073082B305458D444B80B90A76FB35BCC17BEAC4B34CEE5F3264C6F7FE57D8855C68E04AF841
907CF9448D93B7AE92E51543BE7C04B8D43345690B4E5C56965E25E
26039DE2CBF96271E96FCC63555F5914AAD1D2556B7D352BF6C2D903F3B13E29C76DDE810B40E67A0F3
ED1A013FA98D18B68DE19C2FF881244E2C969
ike 2:Japan_ODC: HA state master(2)
ike 2:Japan_ODC:1689768: dec
CCD4FDAB6A42DD3134E797FD7453E4BB2E20240000000AE40000016829000004210000080000400A280
000340000003001030404AD1ED
3400300000C0100000C800E0100030000080300000C0300000804000014000000080500000022000024
0FCBB6B6FBD57E0D6ED224C66F49E7F47F7A42F47A9F10C32FED67A
0E7FC119E2C000068001400009E60194A53DAADA6D256AB4FA1CC845DB4EBDCAC0F8EBB24209A7F225A
EA8EC21F627A50C4E0AD528EE0973FF965319E87A001526BA6F08B0
3288F535AC4A2A358F4D8DF575DDDB01F2038008252BB34ADB772C7ECB7A1705C4CBD777E6E9E472D00
004002000000070000100000FFFF00000000FFFFFFFF08000028000
0FFFF00000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000040020000
00070000100000FFFF00000000FFFFFFFF080000280000FFFF00000
000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
ike 2:Japan_ODC:1689768: received create-child request
ike 2:Japan_ODC:1689768: responder received CREATE_CHILD exchange
ike 2:Japan_ODC:1689768: processing notify type ESP_TFC_PADDING_NOT_SUPPORTED
ike 2:Japan_ODC:1689768: responder creating new child
ike 2:Japan_ODC:1689768:57528: peer proposal:
ike 2:Japan_ODC:1689768:57528: TSi_0 0:0.0.0.0-255.255.255.255:0
ike 2:Japan_ODC:1689768:57528: TSi_1 0:::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:0
ike 2:Japan_ODC:1689768:57528: TSr_0 0:0.0.0.0-255.255.255.255:0
ike 2:Japan_ODC:1689768:57528: TSr_1 0:::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:0
ike 2:Japan_ODC:1689768:Japan_ODC:57528: comparing selectors
ike 2:Japan_ODC:1689768:Japan_ODC:57528: matched by rfc-rule-3
ike 2:Japan_ODC:1689768:Japan_ODC:57528: phase2 matched by subset
ike 2:Japan_ODC:1689768:Japan_ODC:57528: accepted proposal:
ike 2:Japan_ODC:1689768:Japan_ODC:57528: TSi_0 0:0.0.0.0-255.255.255.255:0
ike 2:Japan_ODC:1689768:Japan_ODC:57528: TSr_0 0:0.0.0.0-255.255.255.255:0
ike 2:Japan_ODC:1689768:Japan_ODC:57528: autokey
ike 2:Japan_ODC:1689768:Japan_ODC:57528: incoming child SA proposal:
ike 2:Japan_ODC:1689768:Japan_ODC:57528: proposal id = 1:
ike 2:Japan_ODC:1689768:Japan_ODC:57528: protocol = ESP:
ike 2:Japan_ODC:1689768:Japan_ODC:57528: encapsulation = TUNNEL
ike 2:Japan_ODC:1689768:Japan_ODC:57528: type=ENCR, val=AES_CBC (key_len =
256)
ike 2:Japan_ODC:1689768:Japan_ODC:57528: type=INTEGR, val=SHA256
ike 2:Japan_ODC:1689768:Japan_ODC:57528: type=DH_GROUP, val=ECP384
ike 2:Japan_ODC:1689768:Japan_ODC:57528: type=ESN, val=NO
ike 2:Japan_ODC:1689768:Japan_ODC:57528: my proposal:
ike 2:Japan_ODC:1689768:Japan_ODC:57528: proposal id = 1:
ike 2:Japan_ODC:1689768:Japan_ODC:57528: protocol = ESP:
ike 2:Japan_ODC:1689768:Japan_ODC:57528: encapsulation = TUNNEL
ike 2:Japan_ODC:1689768:Japan_ODC:57528: type=ENCR, val=AES_CBC (key_len =
256)
ike 2:Japan_ODC:1689768:Japan_ODC:57528: type=INTEGR, val=SHA256
ike 2:Japan_ODC:1689768:Japan_ODC:57528: type=DH_GROUP,
al=MODP1536
ike 2:Japan_ODC:1689768:Japan_ODC:57528: type=ESN, val=NO
ike 2:Japan_ODC:1689768:Japan_ODC:57528: lifetime=3600
ike 2:Japan_ODC:1689768:Japan_ODC:57528: no proposal chosen
ike Negotiate SA Error: ike ike [1481]
ike 2:Japan_ODC:1689768:Japan_ODC:57528: responder preparing CREATE_CHILD message
ike 2:Japan_ODC:1689768: enc 000000080000000E0706050403020107
ike 2:Japan_ODC:1689768: out
CCD4FDAB6A42DD3134E797FD7453E4BB2E20242800000AE4000000502900003415F11A887676D36C360
4A2EB4C4F5408C83698B590421
67DA5594FF20E89780E0E1554B2554F442880AFB5D7E895B00B
ike 2:Japan_ODC:1689768: sent IKE msg (CREATE_CHILD_RESPONSE): 192.8.202.121:500-
>61.14.7.148:500, len=80, vrf=0, id=ccd4fdab6a42dd31/34e7
97fd7453e4bb:00000ae4
ike 2:Japan_ODC:1689768:57528: no proposal chosen

FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) # ike 2:Japan_ODC:Japan_ODC: IPsec SA connect 9
192.8.202.121->61.14.7.148:0
ike 2:Japan_ODC:Japan_ODC: using existing connection
ike 2:Japan_ODC:Japan_ODC: traffic triggered, serial=1 1:10.115.90.15:2048-
>1:10.122.28.144:0
ike 2:Japan_ODC:Japan_ODC: config found
ike 2:Japan_ODC: request is on the queue
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) # ike 2: comes 61.14.7.148:500-
>192.8.202.121:500,ifindex=9,vrf=0....
ike 2: IKEv2 exchange=INFORMATIONAL id=ccd4fdab6a42dd31/34e797fd7453e4bb:00000ae5
len=80
ike 2: in
CCD4FDAB6A42DD3134E797FD7453E4BB2E20250000000AE500000050000000344769112900CB639A6FC
505D577053B63E0FD327BE04F19F993D7E5731B8C3FBD
CC08C10370C680D22CD212FAE8D7A3D1
ike 2:Japan_ODC: HA state master(2)
ike 2:Japan_ODC:1689768: dec
CCD4FDAB6A42DD3134E797FD7453E4BB2E20250000000AE50000002000000004
ike 2:Japan_ODC:1689768: received informational request
ike 2:Japan_ODC:1689768: enc 0F0E0D0C0B0A0908070605040302010F
ike 2:Japan_ODC:1689768: out
CCD4FDAB6A42DD3134E797FD7453E4BB2E20252800000AE50000005000000034496E299643AE0C0C3FC
7E351B6C9DE6BED071A9F508E4
351DFAF492138527DCC276DFB1E35E2647BF7E5E84498DF2A7A
ike 2:Japan_ODC:1689768: sent IKE msg (INFORMATIONAL_RESPONSE): 192.8.202.121:500-
>61.14.7.148:500, len=80, vrf=0, id=ccd4fdab6a42dd31/34e
797fd7453e4bb:00000ae5
ike 2:Japan_ODC:Japan_ODC: IPsec SA connect 9 192.8.202.121->61.14.7.148:0
ike 2:Japan_ODC:Japan_ODC: using existing connection
ike 2:Japan_ODC:Japan_ODC: traffic triggered, serial=1 1:10.115.90.15:2048-
>1:10.122.28.144:0
ike 2:Japan_ODC:Japan_ODC: config found
ike 2:Japan_ODC: request is on the queue
ike 2:Japan_ODC:Japan_ODC: IPsec SA connect 9 192.8.202.121->61.14.7.148:0
ike 2:Japan_ODC:Japan_ODC: using existing connection
ike 2:Japan_ODC:Japan_ODC: traffic triggered, serial=1 1:10.115.90.15:2048-
>1:10.122.28.144:0
ike 2:Japan_ODC:Japan_ODC: config found
ike 2:Japan_ODC: request is on the queue
ike 2: comes 61.14.7.148:500->192.8.202.121:500,ifindex=9,vrf=0....
ike 2: IKEv2 exchange=CREATE_CHILD id=ccd4fdab6a42dd31/34e797fd7453e4bb:00000ae6
len=400
ike 2: in
CCD4FDAB6A42DD3134E797FD7453E4BB2E20240000000AE60000019029000174323B09A2A6F520E252B
8FA644FA0B6D910519AEA57A595C02505661B2D9A46F6
560A167A9177374B8433F870B884647F3205AFC4764EC35655AE11E02336CA2FDA41DC1DADE9C048784
F0CE047A6EFAC6AD98E4716EF678FF63C243D78F1029D6C2FD36340
6D56D70C95D38B5EA6C2988BCB2E88D4F162FBAEE5E4F40343B4056EEAAD5D20E29A80AA58EF902A2F3
21A515738EF39F62BC9AB7D02A8171E44458F3C8674902D9CC2C4D2
37C9721A21C2AC288DBF29338A0A6E202715751880F14622268917E71CEAB37A49ACD2C037956011261
774D30AA19648F9EC16455166B115223E058C0959DFF89CEEFB0077
DC381C578004350104CB5A74DE4121905298D344F07BFCB66D33668E4F7897C9BC762CA8AB34999C885
EF6C634FCD3C2F01B21C0C2A6BB73946F32568194D156EAD44BC8C2
4A3AFFD2E6702C3EB846290B4EB57EBE67FD9C927FD404CCE40E35D8AE4AA90FB7743404511A86648A2
05AD2E0DE70700C0588BFB5499F9FC704FB1C
ike 2:Japan_ODC: HA state master(2)
ike 2:Japan_ODC:1689768: dec
CCD4FDAB6A42DD3134E797FD7453E4BB2E20240000000AE60000016829000004210000080000400A280
000340000003001030404CF495
1AA0300000C0100000C800E0100030000080300000C0300000804000014000000080500000022000024
F2846D91EBD374D6C2A7F64D18779C96A46D067473A31C1435F2839
C42049F9E2C00006800140000953FB418CA58399150089DD792A5A0FD1A489ED11DC38BA222B7D3F9F1
839FD050C1FE3D3CD5B30019644BD0542EC6DB916175CE12D4CC7FD
E0DB9EBF16F002ABC6E026A57259D45D45E44660DB3E5E0E208EE089EE9AC257E273D52AFA635672D00
004002000000070000100000FFFF00000000FFFFFFFF08000028000
0FFFF00000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000040020000
00070000100000FFFF00000000FFFFFFFF080000280000FFFF00000
000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
ike 2:Japan_ODC:1689768: received create-child request
ike 2:Japan_ODC:1689768: responder received CREATE_CHILD exchange
ike 2:Japan_ODC:1689768: processing notify type ESP_TFC_PADDING_NOT_SUPPORTED
ike 2:Japan_ODC:1689768: responder creating new child
ike 2:Japan_ODC:1689768:57544: peer proposal:
ike 2:Japan_ODC:1689768:57544: TSi_0 0:0.0.0.0-255.255.255.255:0
ike 2:Japan_ODC:1689768:57544: TSi_1 0:::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:0
ike 2:Japan_ODC:1689768:57544: TSr_0 0:0.0.0.0-255.255.255.255:0
ike 2:Japan_ODC:1689768:57544: TSr_1 0:::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:0
ike 2:Japan_ODC:1689768:Japan_ODC:57544: comparing selectors
ike 2:Japan_ODC:1689768:Japan_ODC:57544: matched by rfc-rule-3
ike 2:Japan_ODC:1689768:Japan_ODC:57544: phase2 matched by subset
ike 2:Japan_ODC:1689768:Japan_ODC:57544: accepted proposal:
ike 2:Japan_ODC:1689768:Japan_ODC:57544: TSi_0 0:0.0.0.0-255.255.255.255:0
ike 2:Japan_ODC:1689768:Japan_ODC:57544: TSr_0 0:0.0.0.0-255.255.255.255:0
ike 2:Japan_ODC:1689768:Japan_ODC:57544: autokey
ike 2:Japan_ODC:1689768:Japan_ODC:57544: incoming child SA proposal:
ike 2:Japan_ODC:1689768:Japan_ODC:57544: proposal id = 1:
ike 2:Japan_ODC:1689768:Japan_ODC:57544: protocol = ESP:
ike 2:Japan_ODC:1689768:Japan_ODC:57544: encapsulation = TUNNEL
ike 2:Japan_ODC:1689768:Japan_ODC:57544: type=ENCR, val=AES_CBC (key_len =
256)
ike 2:Japan_ODC:1689768:Japan_ODC:57544: type=INTEGR, val=SHA256
ike 2:Japan_ODC:1689768:Japan_ODC:57544: type=DH_GROUP, val=ECP384
ike 2:Japan_ODC:1689768:Japan_ODC:57544: type=ESN, val=NO
ike 2:Japan_ODC:1689768:Japan_ODC:57544: my proposal:
ike 2:Japan_ODC:1689768:Japan_ODC:57544: proposal id = 1:
ike 2:Japan_ODC:1689768:Japan_ODC:57544: protocol = ESP:
ike 2:Japan_ODC:1689768:Japan_ODC:57544: encapsulation = TUNNEL
ike 2:Japan_ODC:1689768:Japan_ODC:57544: type=ENCR, val=AES_CBC (key_len =
256)
ike 2:Japan_ODC:1689768:Japan_ODC:57544: type=INTEGR, val=SHA256
ike 2:Japan_ODC:1689768:Japan_ODC:57544: type=DH_GROUP, val=MODP1536
ike 2:Japan_ODC:1689768:Japan_ODC:57544: type=ESN, val=NO
ike 2:Japan_ODC:1689768:Japan_ODC:57544: lifetime=3600
ike 2:Japan_ODC:1689768:Japan_ODC:57544: no proposal chosen
ike Negotiate SA Error: ike ike [1481]
ike 2:Japan_ODC:1689768:Japan_ODC:57544: responder preparing CREATE_CHILD message
ike 2:Japan_ODC:1689768: enc 000000080000000E0706050403020107
ike 2:Japan_ODC:1689768: out
CCD4FDAB6A42DD3134E797FD7453E4BB2E20242800000AE60000005029000034ECC27C78A32EA6D25D8
2800754F2BD668C8CF139D542F
6A2AC4E4CACF460244435291220D6C990DCAEC8A48155F97F0D
ike 2:Japan_ODC:1689768: sent IKE msg (CREATE_CHILD_RESPONSE): 192.8.202.121:500-
>61.14.7.148:500, len=80, vrf=0, id=ccd4fdab6a42dd31/34e7
97fd7453e4bb:00000ae6
ike 2:Japan_ODC:1689768:57544: no proposal chosen

FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) # ike 2:Japan_ODC:Japan_ODC: IPsec SA connect 9
192.8.202.121->61.14.7.148:0
ike 2:Japan_ODC:Japan_ODC: using existing connection
ike 2:Japan_ODC:Japan_ODC: traffic triggered, serial=1 1:10.115.92.47:2048-
>1:10.115.93.242:0
ike 2:Japan_ODC:Japan_ODC: config found
ike 2:Japan_ODC: request is on the queue

FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) # di de ike 2:Japan_ODC:Japan_ODC: IPsec SA connect 9
192.8.202.121->61.14.7.148:0
ike 2:Japan_ODC:Japan_ODC: using existing connection
ike 2:Japan_ODC:Japan_ODC: traffic triggered, serial=1 1:10.115.90.15:2048-
>1:10.115.93.243:0
ike 2:Japan_ODC:Japan_ODC: config found
ike 2:Japan_ODC: request is on the queue
di

FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) # di de di

FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #
FortiGate-2601F (vsys3) #

You might also like