Fortigate and PFSENSE...

aniodon

Hello everyone!

We are trying to create an ipsec tunnel between a pfsense box (latest version) and a fortigate product.
We have tried a lot of settings, with no luck, we have never got the P1 up.

On the pfsense side, nothing really complicated : a pfsense in ha / carp. We have 5 other ipsec up with other clients where we had no particular issue.
On the fortigate side, they have :

a first gateway in a first datacenter. I connect my ipsec to this ip (called : IP-FORTI-P1A).
They have a NAT form the first ip IP-FORTI-P1A to a second datacenter ip : IP-FORTI-P1B
on this second datacenter IP-FORTI-P1B , we have the VPN tunnel where i actually connect through nat.

We tried :

Multi checked the psk, use something small and easy.... 1234 and so on...
Change ike to V2, both side
Change to any encryption settings, both side
Change the « LocalId » to set their IP-FORTI-P1A as id, forti side
Disable P2, pfsense side
With or without NAT transversal on forti side
Main or aggressive mode on both side
DPD on / off…
With no luck.

On IkeV2 we get a MAC mismatch, with any ID settings.

You will find attached :

Topology.jpg : a summary of the topology (see below)
CONF-PFSENSE-StrongSwan.txt : my settings : 1_1532526472136_CONF-PFSENSE-StrongSwan.txt
CONF-FORTIGATE-ON_DCE.txt : their settings : 0_1532526472135_CONF-FORTIGATE-ON_DCE.txt
LOGS_FORTI_DTO.txt : their logs on first datacenter : 3_1532526472136_LOGS_FORTI_DTO.txt
LOGS_FORTI_DCE.txt : their logs on second datacenter : 2_1532526472136_LOGS_FORTI_DCE.txt
LOGS_PFSENSE.txt : my logs 4_1532526472136_LOGS_PFSENSE.txt

Has anyone some directions to point me to ?

Thanks in advance…

olivier

gersonofstone

i see your log and i think that problem with Phase 1 Pre-Shared Key Mismatch,

Do you can check the pre-shared?

look this

https://www.netgate.com/docs/pfsense/vpn/ipsec/ipsec-troubleshooting.html

aniodon

Hello and thanks for your answer.

In fact, we saw some posts on the net with this log, pointing to a psk mismatch.
We made a lot (LOT) of tests with a lot of different PSK, the P1 never got up.

we tried some '1234', 'test', and so on, psk's ...