Hi all, I'm trying to create a vpn between my cisco 2651 and a fortigate 100 I've some problem, I think, when the vpn's 2 phase begins
Here my conf: crypto isakmp policy 10 encr 3des authentication pre-share group 2 ! crypto isakmp policy 15 encr 3des hash md5 authentication pre-share group 2 ! crypto isakmp policy 35 hash md5 authentication pre-share group 2 ! crypto isakmp policy 40 encr 3des hash md5 authentication pre-share ! crypto isakmp key address ! crypto ipsec transform-set 3des_md5 esp-3des esp-md5-hmac ! crypto map vpn 100 ipsec-isakmp description set peer set transform-set 3des_md5 set pfs group2 match address 151 ! access-list 151 permit ip host 192.168.1.93 10.10.10.0 0.0.0.255 access-list 151 permit ip host 192.168.1.93 192.168.21.0 0.0.0.255 access-list 151 permit ip 192.168.11.0 0.0.0.255 192.168.21.0
0.0.0.255...and here my debug...
*Aug 10 12:00:18.369: ISAKMP:(0:104:HW:2): processing HASH payload. message ID = 0 *Aug 10 12:00:18.373: ISAKMP:(0:104:HW:2):SA authentication status: *Aug 10 12:00:18.373: ISAKMP:(0:104:HW:2): authenticated *Aug 10 12:00:18.373: ISAKMP:(0:104:HW:2):SA has been authenticated with *Aug 10 12:00:18.373: ISAKMP:(0:104:HW:2):: peer matches *none* of the profiles *Aug 10 12:00:18.373: ISAKMP: Trying to insert a peer / /500/, and inserted successfully. *Aug 10 12:00:18.373: ISAKMP:(0:104:HW:2):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Aug 10 12:00:18.373: ISAKMP:(0:104:HW:2):Old State = IKE_I_MM6 New State = IKE_I_MM6*Aug 10 12:00:18.377: ISAKMP:(0:104:HW:2):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Aug 10 12:00:18.377: ISAKMP:(0:104:HW:2):Old State = IKE_I_MM6 New State = IKE_P1_COMPLETE*Aug 10 12:00:18.377: ISAKMP:(0:104:HW:2):beginning Quick Mode exchange, M-ID of -948673120
*Aug 10 12:00:18.389: ISAKMP:(0:104:HW:2): sending packet to my_port 500 peer_port 500 (I) QM_IDLE *Aug 10 12:00:18.393: ISAKMP:(0:104:HW:2):Node -948673120, Input = IKE_MESG_INTERNAL, IKE_INIT_QM *Aug 10 12:00:18.393: ISAKMP:(0:104:HW:2):Old State = IKE_QM_READY New State = IKE_QM_I_QM1 *Aug 10 12:00:18.393: ISAKMP:(0:104:HW:2):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE *Aug 10 12:00:18.393: ISAKMP:(0:104:HW:2):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE*Aug 10 12:00:20.104: ISAKMP (0:268435560): received packet from dport 500 sport 500 Global (I) QM_IDLE
*Aug 10 12:00:20.104: ISAKMP: set new node 311940652 to QM_IDLE *Aug 10 12:00:20.108: ISAKMP:(0:104:HW:2): processing HASH payload. message ID = 311940652 *Aug 10 12:00:20.108: %CRYPTO-6-IKMP_BAD_DOI_NOTIFY: DOI of 0 in notify message from *Aug 10 12:00:20.108: ISAKMP:(0:104:HW:2):incrementing error counter on sa: IKMP_BAD_DOI_NOTIFY *Aug 10 12:00:20.108: ISAKMP:(0:104:HW:2): processing NOTIFY PROPOSAL_NOT_CHOSEN protocol 1 spi 0, message ID = 311940652, sa = 857A617C *Aug 10 12:00:20.108: ISAKMP:(0:104:HW:2):peer does not do paranoid keepalives.*Aug 10 12:00:20.108: ISAKMP:(0:104:HW:2):deleting SA reason "recevied fatal informational" state (I) QM_IDLE (peer ) input queue 0
*Aug 10 12:00:20.108: ISAKMP:(0:104:HW:2):deleting node 311940652 error FALSE reason "informational (in) state 1" *Aug 10 12:00:20.112: ISAKMP:(0:104:HW:2):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY *Aug 10 12:00:20.112: ISAKMP:(0:104:HW:2):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE*Aug 10 12:00:20.112: ISAKMP: set new node 1841500615 to QM_IDLE
*Aug 10 12:00:20.116: ISAKMP:(0:104:HW:2): sending packet to my_port 500 peer_port 500 (I) QM_IDLE *Aug 10 12:00:20.116: ISAKMP:(0:104:HW:2):purging node 1841500615 *Aug 10 12:00:20.116: ISAKMP:(0:104:HW:2):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL *Aug 10 12:00:20.116: ISAKMP:(0:104:HW:2):Old State = IKE_P1_COMPLETE New State = IKE_DEST_SA*Aug 10 12:00:20.120: ISAKMP:(0:104:HW:2):deleting SA reason "" state (I) QM_IDLE (peer ) input queue 0
*Aug 10 12:00:20.120: ISAKMP: Unlocking IKE struct 0x8566D144 for isadb_mark_sa_deleted(), count 0 *Aug 10 12:00:20.120: ISAKMP: Deleting peer node by peer_reap for : 8566D144 *Aug 10 12:00:20.120: ISAKMP:(0:104:HW:2):deleting node -948673120 error FALSE reason "" *Aug 10 12:00:20.120: ISAKMP:(0:104:HW:2):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Aug 10 12:00:20.120: ISAKMP:(0:104:HW:2):Old State = IKE_DEST_SA New State = IKE_DEST_SA*Aug 10 12:00:20.469: ISAKMP (0:268435560): received packet from dport 500 sport 500 Global (I) MM_NO_STATE
*Aug 10 12:00:45.117: IPSEC(key_engine): request timer fired: count = 1, (identity) local= , remote= , local_proxy= 192.168.1.93/255.255.255.255/0/0 (type=1), remote_proxy= 10.10.10.0/255.255.255.0/0/0 (type=4) *Aug 10 12:00:45.117: IPSEC(sa_request): , (key eng. msg.) OUTBOUND local= , remote= , local_proxy= 192.168.1.93/255.255.255.255/0/0 (type=1), remote_proxy= 10.10.10.0/255.255.255.0/0/0 (type=4), protocol= ESP, transform= esp-3des esp-md5-hmac , lifedur= 3600s and 4608000kb, spi= 0xEE335F2A(3996344106), conn_id= 0, keysize= 0, flags= 0x400B *Aug 10 12:00:45.117: ISAKMP: received ke message (1/1) *Aug 10 12:00:45.121: ISAKMP:(0:0:N/A:0): SA request profile is (NULL) *Aug 10 12:00:45.121: ISAKMP: Created a peer struct for , peer port 500 *Aug 10 12:00:45.121: ISAKMP: Locking peer struct 0x856D0A24, IKE refcount 1 for isakmp_initiator *Aug 10 12:00:45.121: ISAKMP: local port 500, remote port 500 *Aug 10 12:00:45.121: ISAKMP: set new node 0 to QM_IDLE *Aug 10 12:00:45.121: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 857AA938 *Aug 10 12:00:45.121: ISAKMP:(0:105:HW:2):Can not start Aggressive mode, trying Main mode. *Aug 10 12:00:45.121: ISAKMP: Looking for a matching key for in default : success *Aug 10 12:00:45.121: ISAKMP:(0:105:HW:2):found peer pre-shared key matching *Aug 10 12:00:45.125: ISAKMP:(0:105:HW:2): constructed NAT-T vendor-03 ID *Aug 10 12:00:45.125: ISAKMP:(0:105:HW:2): constructed NAT-T vendor-02 ID *Aug 10 12:00:45.125: ISAKMP:(0:105:HW:2):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM *Aug 10 12:00:45.125: ISAKMP:(0:105:HW:2):Old State = IKE_READY New State = IKE_I_MM1*Aug 10 12:00:45.125: ISAKMP:(0:105:HW:2): beginning Main Mode exchange
*Aug 10 12:00:45.125: ISAKMP:(0:105:HW:2): sending packet to my_port 500 peer_port 500 (I) MM_NO_STATE *Aug 10 12:00:45.810: ISAKMP (0:268435561): received packet from dport 500 sport 500 Global (I) MM_NO_STATE *Aug 10 12:00:45.810: ISAKMP:(0:105:HW:2):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Aug 10 12:00:45.810: ISAKMP:(0:105:HW:2):Old State = IKE_I_MM1 New State = IKE_I_MM2*Aug 10 12:00:45.810: ISAKMP:(0:105:HW:2): processing SA payload. message ID = 0
*Aug 10 12:00:45.810: ISAKMP:(0:105:HW:2): processing vendor id payload *Aug 10 12:00:45.810: ISAKMP:(0:105:HW:2): vendor ID seems Unity/DPD but major 233 mismatch *Aug 10 12:00:45.814: ISAKMP: Looking for a matching key for in default : success *Aug 10 12:00:45.814: ISAKMP:(0:105:HW:2):found peer pre-shared key matching *Aug 10 12:00:45.814: ISAKMP:(0:105:HW:2): local preshared key found *Aug 10 12:00:45.814: ISAKMP : Scanning profiles for xauth ... *Aug 10 12:00:45.814: ISAKMP:(0:105:HW:2):Checking ISAKMP transform 2 against priority 10 policy *Aug 10 12:00:45.814: ISAKMP: encryption 3DES-CBC *Aug 10 12:00:45.814: ISAKMP: hash MD5 *Aug 10 12:00:45.814: ISAKMP: default group 2 *Aug 10 12:00:45.814: ISAKMP: auth pre-share *Aug 10 12:00:45.814: ISAKMP: life type in seconds *Aug 10 12:00:45.814: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80 *Aug 10 12:00:45.814: ISAKMP:(0:105:HW:2):Hash algorithm offered does not match policy! *Aug 10 12:00:45.814: ISAKMP:(0:105:HW:2):atts are not acceptable. Next payload is 0 *Aug 10 12:00:45.814: ISAKMP:(0:105:HW:2):Checking ISAKMP transform 2 against priority 15 policy *Aug 10 12:00:45.818: ISAKMP: encryption 3DES-CBC *Aug 10 12:00:45.818: ISAKMP: hash MD5 *Aug 10 12:00:45.818: ISAKMP: default group 2 *Aug 10 12:00:45.818: ISAKMP: auth pre-share *Aug 10 12:00:45.818: ISAKMP: life type in seconds *Aug 10 12:00:45.818: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80 *Aug 10 12:00:45.818: ISAKMP:(0:105:HW:2):atts are acceptable. Next payload is 0 *Aug 10 12:00:45.826: ISAKMP:(0:105:HW:2): processing vendor id payload *Aug 10 12:00:45.826: ISAKMP:(0:105:HW:2): vendor ID seems Unity/DPD but major 233 mismatch *Aug 10 12:00:45.826: ISAKMP:(0:105:HW:2):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Aug 10 12:00:45.826: ISAKMP:(0:105:HW:2):Old State = IKE_I_MM2 New State = IKE_I_MM2*Aug 10 12:00:45.830: ISAKMP:(0:105:HW:2): sending packet to my_port 500 peer_port 500 (I) MM_SA_SETUP
*Aug 10 12:00:45.830: ISAKMP:(0:105:HW:2):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Aug 10 12:00:45.830: ISAKMP:(0:105:HW:2):Old State = IKE_I_MM2 New State = IKE_I_MM3*Aug 10 12:00:47.613: ISAKMP (0:268435561): received packet from dport 500 sport 500 Global (I) MM_SA_SETUP
*Aug 10 12:00:47.613: ISAKMP:(0:105:HW:2):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Aug 10 12:00:47.613: ISAKMP:(0:105:HW:2):Old State = IKE_I_MM3 New State = IKE_I_MM4*Aug 10 12:00:47.617: ISAKMP:(0:105:HW:2): processing KE payload. message ID = 0
*Aug 10 12:00:47.621: ISAKMP:(0:105:HW:2): processing NONCE payload. message ID = 0 *Aug 10 12:00:47.625: ISAKMP: Looking for a matching key for in default : success *Aug 10 12:00:47.625: ISAKMP:(0:105:HW:2):found peer pre-shared key matching *Aug 10 12:00:47.625: ISAKMP: Looking for a matching key for in default : success *Aug 10 12:00:47.625: ISAKMP:(0:105:HW:2):found peer pre-shared key matching *Aug 10 12:00:47.629: ISAKMP:(0:105:HW:2):SKEYID state generated *Aug 10 12:00:47.629: ISAKMP:(0:105:HW:2):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Aug 10 12:00:47.629: ISAKMP:(0:105:HW:2):Old State = IKE_I_MM4 New State = IKE_I_MM4*Aug 10 12:00:47.633: ISAKMP:(0:105:HW:2):Send initial contact
*Aug 10 12:00:47.633: ISAKMP:(0:105:HW:2):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR *Aug 10 12:00:47.633: ISAKMP (0:268435561): ID payload next-payload : 8 type : 1 address : protocol : 17 port : 500 length : 12 *Aug 10 12:00:47.633: ISAKMP:(0:105:HW:2):Total payload length: 12 *Aug 10 12:00:47.637: ISAKMP:(0:105:HW:2): sending packet to my_port 500 peer_port 500 (I) MM_KEY_EXCH *Aug 10 12:00:47.637: ISAKMP:(0:105:HW:2):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Aug 10 12:00:47.637: ISAKMP:(0:105:HW:2):Old State = IKE_I_MM4 New State = IKE_I_MM5*Aug 10 12:00:47.890: ISAKMP (0:268435561): received packet from dport 500 sport 500 Global (I) MM_KEY_EXCH
*Aug 10 12:00:47.894: ISAKMP:(0:105:HW:2):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Aug 10 12:00:47.894: ISAKMP:(0:105:HW:2):Old State = IKE_I_MM5 New State = IKE_I_MM6*Aug 10 12:00:47.894: ISAKMP:(0:105:HW:2): processing ID payload. message ID = 0
*Aug 10 12:00:47.894: ISAKMP (0:268435561): ID payload next-payload : 8 type : 1 address : protocol : 0 port : 0 length : 12 *Aug 10 12:00:47.894: ISAKMP:(0:105:HW:2): processing HASH payload. message ID = 0 *Aug 10 12:00:47.898: ISAKMP:(0:105:HW:2):SA authentication status: *Aug 10 12:00:47.898: ISAKMP:(0:105:HW:2): authenticated *Aug 10 12:00:47.898: ISAKMP:(0:105:HW:2):SA has been authenticated with *Aug 10 12:00:47.898: ISAKMP:(0:105:HW:2):: peer matches *none* of the profiles *Aug 10 12:00:47.898: ISAKMP: Trying to insert a peer / /500/, and inserted successfully. *Aug 10 12:00:47.898: ISAKMP:(0:105:HW:2):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Aug 10 12:00:47.898: ISAKMP:(0:105:HW:2):Old State = IKE_I_MM6 New State = IKE_I_MM6*Aug 10 12:00:47.902: ISAKMP:(0:105:HW:2):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Aug 10 12:00:47.902: ISAKMP:(0:105:HW:2):Old State = IKE_I_MM6 New State = IKE_P1_COMPLETE*Aug 10 12:00:47.902: ISAKMP:(0:105:HW:2):beginning Quick Mode exchange, M-ID of -1210640676
*Aug 10 12:00:47.914: ISAKMP:(0:105:HW:2): sending packet to my_port 500 peer_port 500 (I) QM_IDLE *Aug 10 12:00:47.918: ISAKMP:(0:105:HW:2):Node -1210640676, Input = IKE_MESG_INTERNAL, IKE_INIT_QM *Aug 10 12:00:47.918: ISAKMP:(0:105:HW:2):Old State = IKE_QM_READY New State = IKE_QM_I_QM1 *Aug 10 12:00:47.918: ISAKMP:(0:105:HW:2):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE *Aug 10 12:00:47.918: ISAKMP:(0:105:HW:2):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE*Aug 10 12:00:48.547: ISAKMP (0:268435561): received packet from dport 500 sport 500 Global (I) QM_IDLE
*Aug 10 12:00:48.547: ISAKMP: set new node 917352592 to QM_IDLE *Aug 10 12:00:48.551: ISAKMP:(0:105:HW:2): processing HASH payload. message ID = 917352592 *Aug 10 12:00:48.551: ISAKMP:(0:105:HW:2):incrementing error counter on sa: IKMP_BAD_DOI_NOTIFY *Aug 10 12:00:48.551: ISAKMP:(0:105:HW:2): processing NOTIFY PROPOSAL_NOT_CHOSEN protocol 1 spi 0, message ID = 917352592, sa = 857AA938 *Aug 10 12:00:48.551: ISAKMP:(0:105:HW:2):peer does not do paranoid keepalives.*Aug 10 12:00:48.551: ISAKMP:(0:105:HW:2):deleting SA reason "recevied fatal informational" state (I) QM_IDLE (peer ) input queue 0
*Aug 10 12:00:48.551: ISAKMP:(0:105:HW:2):deleting node 917352592 error FALSE reason "informational (in) state 1" *Aug 10 12:00:48.551: ISAKMP:(0:105:HW:2):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY *Aug 10 12:00:48.551: ISAKMP:(0:105:HW:2):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE*Aug 10 12:00:48.555: ISAKMP: set new node 2051526023 to QM_IDLE
*Aug 10 12:00:48.559: ISAKMP:(0:105:HW:2): sending packet to my_port 500 peer_port 500 (I) QM_IDLE *Aug 10 12:00:48.559: ISAKMP:(0:105:HW:2):purging node 2051526023 *Aug 10 12:00:48.559: ISAKMP:(0:105:HW:2):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL *Aug 10 12:00:48.559: ISAKMP:(0:105:HW:2):Old State = IKE_P1_COMPLETE New State = IKE_DEST_SA*Aug 10 12:00:48.559: ISAKMP:(0:105:HW:2):deleting SA reason "" state (I) QM_IDLE (peer ) input queue 0
*Aug 10 12:00:48.559: ISAKMP: Unlocking IKE struct 0x856D0A24 for isadb_mark_sa_deleted(), count 0 *Aug 10 12:00:48.559: ISAKMP: Deleting peer node by peer_reap for : 856D0A24 *Aug 10 12:00:48.563: ISAKMP:(0:105:HW:2):deleting node -1210640676 error FALSE reason "" *Aug 10 12:00:48.563: ISAKMP:(0:105:HW:2):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Aug 10 12:00:48.563: ISAKMP:(0:105:HW:2):Old State = IKE_DEST_SA New State = IKE_DEST_SA*Aug 10 12:00:48.835: ISAKMP (0:268435561): received packet from dport 500 sport 500 Global (I) MM_NO_STATE
*Aug 10 12:01:10.114: ISAKMP:(0:104:HW:2):purging node 311940652 *Aug 10 12:01:10.122: ISAKMP:(0:104:HW:2):purging node -948673120 *Aug 10 12:01:15.118: IPSEC(key_engine): request timer fired: count = 2, (identity) local= , remote= , local_proxy= 192.168.1.93/255.255.255.255/0/0 (type=1), remote_proxy= 10.10.10.0/255.255.255.0/0/0 (type=4) *Aug 10 12:01:15.118: ISAKMP: received ke message (3/1) *Aug 10 12:01:15.122: ISAKMP:(0:105:HW:2):peer does not do paranoid keepalives.*Aug 10 12:01:15.122: ISAKMP:(0:104:HW:2):peer does not do paranoid keepalives.
I think that the problems starts here ...
*Aug 10 12:00:20.108: %CRYPTO-6-IKMP_BAD_DOI_NOTIFY: DOI of 0 in notify message from *Aug 10 12:00:20.108: ISAKMP:(0:104:HW:2):incrementing error counter on sa: IKMP_BAD_DOI_NOTIFY ....Thank you, Ginevra J.