Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense –> Fortinet

    Scheduled Pinned Locked Moved IPsec
    11 Posts 5 Posters 16.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      sventunus
      last edited by

      Something seems to be wrong in your P1 obviously…
      Please login to your pfSense over SSH & start racoon in debug mode:

      racoon -d -v -F -f /var/etc/racoon.conf

      Post the output of that command here & then we might be able to tell you more.

      1 Reply Last reply Reply Quote 0
      • S
        SoloIT
        last edited by

        Here is my log file, hope you see something I've missed:

        
# 1 "log.txt"
# 1 "<built-in>"
# 1 "<command-line>"
# 1 "log.txt"
Foreground mode.
2013-06-06 09:18:47: INFO: @(#)ipsec-tools 0.8.0 (http:
2013-06-06 09:18:47: INFO: @(#)This product linked OpenSSL 0.9.8y 5 Feb 2013 (http:
2013-06-06 09:18:47: INFO: Reading configuration from "/var/etc/racoon.conf"
2013-06-06 09:18:47: DEBUG: call pfkey_send_register for AH
2013-06-06 09:18:47: DEBUG: call pfkey_send_register for ESP
2013-06-06 09:18:47: DEBUG: call pfkey_send_register for IPCOMP
2013-06-06 09:18:47: DEBUG: reading config file /var/etc/racoon.conf
2013-06-06 09:18:47: DEBUG: no check of compression algorithm; not supported in sadb message.
2013-06-06 09:18:47: DEBUG: getsainfo params: loc='192.168.10.0/24' rmt='10.10.1.0/24' peer='NULL' client='NULL' id=1
2013-06-06 09:18:47: DEBUG: open /var/db/racoon/racoon.sock as racoon management.
2013-06-06 09:18:47: INFO: X.X.X.133[4500] used for NAT-T
2013-06-06 09:18:47: INFO: X.X.X.133[4500] used as isakmp port (fd=7)
2013-06-06 09:18:47: INFO: X.X.X.133[500] used for NAT-T
2013-06-06 09:18:47: INFO: X.X.X.133[500] used as isakmp port (fd=8)
2013-06-06 09:18:47: DEBUG: pk_recv: retry[0] recv()
2013-06-06 09:18:47: DEBUG: got pfkey X_SPDDUMP message
2013-06-06 09:18:47: DEBUG: pk_recv: retry[0] recv()
2013-06-06 09:18:47: DEBUG: got pfkey X_SPDDUMP message
2013-06-06 09:18:47: DEBUG: sub:0xbfbfe654: 10.10.1.0/24[0] 192.168.10.0/24[0] proto=any dir=in
2013-06-06 09:18:47: DEBUG: db :0x2854b148: 192.168.10.0/24[0] 192.168.10.1/32[0] proto=any dir=in
2013-06-06 09:18:47: DEBUG: pk_recv: retry[0] recv()
2013-06-06 09:18:47: DEBUG: got pfkey X_SPDDUMP message
2013-06-06 09:18:47: DEBUG: sub:0xbfbfe654: 192.168.10.1/32[0] 192.168.10.0/24[0] proto=any dir=out
2013-06-06 09:18:47: DEBUG: db :0x2854b148: 192.168.10.0/24[0] 192.168.10.1/32[0] proto=any dir=in
2013-06-06 09:18:47: DEBUG: sub:0xbfbfe654: 192.168.10.1/32[0] 192.168.10.0/24[0] proto=any dir=out
2013-06-06 09:18:47: DEBUG: db :0x2854b288: 10.10.1.0/24[0] 192.168.10.0/24[0] proto=any dir=in
2013-06-06 09:18:47: DEBUG: pk_recv: retry[0] recv()
2013-06-06 09:18:47: DEBUG: got pfkey X_SPDDUMP message
2013-06-06 09:18:47: DEBUG: sub:0xbfbfe654: 192.168.10.0/24[0] 10.10.1.0/24[0] proto=any dir=out
2013-06-06 09:18:47: DEBUG: db :0x2854b148: 192.168.10.0/24[0] 192.168.10.1/32[0] proto=any dir=in
2013-06-06 09:18:47: DEBUG: sub:0xbfbfe654: 192.168.10.0/24[0] 10.10.1.0/24[0] proto=any dir=out
2013-06-06 09:18:47: DEBUG: db :0x2854b288: 10.10.1.0/24[0] 192.168.10.0/24[0] proto=any dir=in
2013-06-06 09:18:47: DEBUG: sub:0xbfbfe654: 192.168.10.0/24[0] 10.10.1.0/24[0] proto=any dir=out
2013-06-06 09:18:47: DEBUG: db :0x2854b508: 192.168.10.1/32[0] 192.168.10.0/24[0] proto=any dir=out
2013-06-06 09:19:32: DEBUG: pk_recv: retry[0] recv()
2013-06-06 09:19:32: DEBUG: got pfkey ACQUIRE message
2013-06-06 09:19:32: DEBUG: suitable outbound SP found: 192.168.10.0/24[0] 10.10.1.0/24[0] proto=any dir=out.
2013-06-06 09:19:32: DEBUG: sub:0xbfbfe658: 10.10.1.0/24[0] 192.168.10.0/24[0] proto=any dir=in
2013-06-06 09:19:32: DEBUG: db :0x2854b148: 192.168.10.0/24[0] 192.168.10.1/32[0] proto=any dir=in
2013-06-06 09:19:32: DEBUG: sub:0xbfbfe658: 10.10.1.0/24[0] 192.168.10.0/24[0] proto=any dir=in
2013-06-06 09:19:32: DEBUG: db :0x2854b288: 10.10.1.0/24[0] 192.168.10.0/24[0] proto=any dir=in
2013-06-06 09:19:32: DEBUG: suitable inbound SP found: 10.10.1.0/24[0] 192.168.10.0/24[0] proto=any dir=in.
2013-06-06 09:19:32: DEBUG: new acquire 192.168.10.0/24[0] 10.10.1.0/24[0] proto=any dir=out
2013-06-06 09:19:32: [X.X.X.130] DEBUG: configuration "X.X.X.130[500]" selected.
2013-06-06 09:19:32: DEBUG: getsainfo params: loc='192.168.10.0/24' rmt='10.10.1.0/24' peer='NULL' client='NULL' id=1
2013-06-06 09:19:32: DEBUG: evaluating sainfo: loc='192.168.10.0/24', rmt='10.10.1.0/24', peer='ANY', id=1
2013-06-06 09:19:32: DEBUG: check and compare ids : values matched (IPv4_subnet)
2013-06-06 09:19:32: DEBUG: cmpid target: '192.168.10.0/24'
2013-06-06 09:19:32: DEBUG: cmpid source: '192.168.10.0/24'
2013-06-06 09:19:32: DEBUG: check and compare ids : values matched (IPv4_subnet)
2013-06-06 09:19:32: DEBUG: cmpid target: '10.10.1.0/24'
2013-06-06 09:19:32: DEBUG: cmpid source: '10.10.1.0/24'
2013-06-06 09:19:32: DEBUG: selected sainfo: loc='192.168.10.0/24', rmt='10.10.1.0/24', peer='ANY', id=1
2013-06-06 09:19:32: DEBUG: (proto_id=ESP spisize=4 spi=00000000 spi_p=00000000 encmode=Tunnel reqid=16388:16387)
2013-06-06 09:19:32: DEBUG: (trns_id=3DES encklen=0 authtype=hmac-sha)
2013-06-06 09:19:32: DEBUG: in post_acquire
2013-06-06 09:19:32: [X.X.X.130] DEBUG: configuration "X.X.X.130[500]" selected.
2013-06-06 09:19:32: INFO: IPsec-SA request for X.X.X.130 queued due to no phase1 found.
2013-06-06 09:19:32: DEBUG: ===
2013-06-06 09:19:32: INFO: initiate new phase 1 negotiation: X.X.X.133[500]<=>X.X.X.130[500]
2013-06-06 09:19:32: INFO: begin Identity Protection mode.
2013-06-06 09:19:32: DEBUG: new cookie:
2f7d78998fba1117
2013-06-06 09:19:32: DEBUG: add payload of len 48, next type 13
2013-06-06 09:19:32: DEBUG: add payload of len 16, next type 13
2013-06-06 09:19:32: DEBUG: add payload of len 16, next type 13
2013-06-06 09:19:32: DEBUG: add payload of len 16, next type 13
2013-06-06 09:19:32: DEBUG: add payload of len 16, next type 13
2013-06-06 09:19:32: DEBUG: add payload of len 20, next type 13
2013-06-06 09:19:32: DEBUG: add payload of len 16, next type 0
2013-06-06 09:19:32: DEBUG: 204 bytes from X.X.X.133[500] to X.X.X.130[500]
2013-06-06 09:19:32: DEBUG: sockname X.X.X.133[500]
2013-06-06 09:19:32: DEBUG: send packet from X.X.X.133[500]
2013-06-06 09:19:32: DEBUG: send packet to X.X.X.130[500]
2013-06-06 09:19:32: DEBUG: 1 times of 204 bytes message will be sent to X.X.X.130[500]
2013-06-06 09:19:32: DEBUG:
2f7d7899 8fba1117 00000000 00000000 01100200 00000000 000000cc 0d000034
00000001 00000001 00000028 01010001 00000020 01010000 800b0001 800c3840
80010005 80030001 80020002 80040002 0d000014 4a131c81 07035845 5c5728f2
0e95452f 0d000014 cd604643 35df21f8 7cfdb2fc 68b6a448 0d000014 90cb8091
3ebb696e 086381b5 ec427b1f 0d000014 4485152d 18b6bbcd 0be8a846 9579ddcc
0d000018 4048b7d5 6ebce885 25e7de7f 00d6c2d3 80000000 00000014 afcad713
68a1f1c9 6b8696fc 77570100
2013-06-06 09:19:32: DEBUG: resend phase1 packet 2f7d78998fba1117:0000000000000000
2013-06-06 09:19:42: DEBUG: 204 bytes from X.X.X.133[500] to X.X.X.130[500]
2013-06-06 09:19:42: DEBUG: sockname X.X.X.133[500]
2013-06-06 09:19:42: DEBUG: send packet from X.X.X.133[500]
2013-06-06 09:19:42: DEBUG: send packet to X.X.X.130[500]
2013-06-06 09:19:42: DEBUG: 1 times of 204 bytes message will be sent to X.X.X.130[500]
2013-06-06 09:19:42: DEBUG:
2f7d7899 8fba1117 00000000 00000000 01100200 00000000 000000cc 0d000034
00000001 00000001 00000028 01010001 00000020 01010000 800b0001 800c3840
80010005 80030001 80020002 80040002 0d000014 4a131c81 07035845 5c5728f2
0e95452f 0d000014 cd604643 35df21f8 7cfdb2fc 68b6a448 0d000014 90cb8091
3ebb696e 086381b5 ec427b1f 0d000014 4485152d 18b6bbcd 0be8a846 9579ddcc
0d000018 4048b7d5 6ebce885 25e7de7f 00d6c2d3 80000000 00000014 afcad713
68a1f1c9 6b8696fc 77570100
2013-06-06 09:19:42: DEBUG: resend phase1 packet 2f7d78998fba1117:0000000000000000
2013-06-06 09:19:47: INFO: caught signal 2
2013-06-06 09:19:47: INFO: racoon process 53748 shutdown</command-line></built-in>
        1 Reply Last reply Reply Quote 0
        • S
          SoloIT
          last edited by

          I have finally found my issues.
          First, you have to have all the routing and firewall configuration in place or the Fortinet box will not respond properly.
          Second, you have to fill the quick mode selector in the phase 2 on the Fortinet or the sa credentials will not match up.

          I do wish all the IPSEC VPN naming was consistent across platforms. It would make this easier for everyone.

          1 Reply Last reply Reply Quote 0
          • X
            xarlygt
            last edited by

            Hi, SoloIT

            Please could you explain how did you configured quick mode selector on Fortigate?

            Thank you

            1 Reply Last reply Reply Quote 0
            • S
              SoloIT
              last edited by

              I just had to put the sub-net address in the quick selector configuration for source and destination. Let me know if I can be of any more assistance.

              1 Reply Last reply Reply Quote 0
              • X
                xarlygt
                last edited by

                I have no luck, iam very frustrated because i hve the same error
                racoon: ERROR: phase1 negotiation failed due to time up. dacc1ad7e688fb70:5b061c7c04c2cc93

                bu i cannot fix it…

                Could you look at this captures of my config?, maybe i am doing somethinh wrong
                One thing on quick mode selector after selecting the alias of networks and clic OK, radio buttons are gone again but I can see the config with cli as set...

                Also I have added firewall rules on both firewall to allow all ipsec traffic

                Or if you are so kind to show me your config i would really appreciate it

                Thank you in advance

                phase1.png
                phase1.png_thumb
                phase2.png
                phase2.png_thumb
                image001.png
                image001.png_thumb
                image002.png
                image002.png_thumb

                1 Reply Last reply Reply Quote 0
                • S
                  SoloIT
                  last edited by

                  Sorry, I don't see anything wrong. I do use the perfect forward secrecy (PFS), but since both your's are disabled, I don't think that's an issue. Also, I used specific address in the quick select rather than alias. You should try putting in the ip address here. Though it should not make a difference, these settings can be picky. Lastly, double check your all your IP address and ensure there is not a typo or mismatched sub net.

                  Hope you find the problem

                  1 Reply Last reply Reply Quote 0
                  • B
                    BeerHat
                    last edited by

                    @SoloIT:

                    I have finally found my issues.
                    First, you have to have all the routing and firewall configuration in place or the Fortinet box will not respond properly.
                    Second, you have to fill the quick mode selector in the phase 2 on the Fortinet or the sa credentials will not match up.

                    I do wish all the IPSEC VPN naming was consistent across platforms. It would make this easier for everyone.

                    Ugh.. Can't stand Fortigate.  Have 4 remote dentist offices with 50 and 60A's nailed to a pfsense 2.03 FW via ipsec.  It works I guess.. but kludgey pay-for-everything interface bugs, and so does their overheating hardware.  Can't wait to drop in some pfsense replacements.  Yes.  I'm complaining about 13 year old hardware.  :0p

                    1 Reply Last reply Reply Quote 0
                    • V
                      vramar2000
                      last edited by

                      Hi,

                      We have created the tunnel between source - pfsense and destination - fortigate firewall. From Destination- Fortigate LAN users are able to reach pfsense LAN.

                      But, From pfsense LAN not able to Fortigate LAN,

                      Can any one please help me, what rule need to be create in pfsense to access destination fortigate LAN network

                      Regards,
                      Ramar V
                      09538162193

                      1 Reply Last reply Reply Quote 0
                      • S
                        SoloIT
                        last edited by

                        Did you create a firewall rule on the pFsense on the IPSec tab?

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.