1

We have a site to site VPN connection to a branch office. Once in a while the connection drops for some reason and then we receive an error like this on the Fortigate 310b

ike Negotiate ISAKMP SA Error: ike 3:20b27f143b809b23/0000000000000000:0: no SA proposal chosen

It is a struggle to re-establish the connection, and I only manage it through trial and error. My question now is, how can I debug this further? I'm aware of the CLI command

diag debug application ike -1
diag debug enable

This gives me the above mentioned error, but this error seems to be thrown for a number of reasons, and I can't figure out for which one exactly. We already lost a lot of time with those problems, and I need to learn to debug and troubleshoot those issues to the core, otherwise I'm lost.

Any help greatly appreciated.

  • 1
    You should post more of your debug information. ISAKMP SA Error can mean many things. – user36472 Jul 14 '17 at 13:36
  • Exactly, ISAKMP SA Error can mean many things. How do i pin it down to the cause? I am asking for a deeper way of debugging, not getting THIS configuration right. – F.H. Jul 14 '17 at 14:35
  • Well that is a problem we all face... Try and error would be my answer. – user36472 Jul 14 '17 at 16:25
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 13 '17 at 16:29
1

no SA proposal chosen means that the security association doesn't match on both sides. Maybe a keylife time in one side is 86400 and in the other side is 86400.

You should post IKE phase 1 and phase2 from each fortigate.

Sometimes, in the config both sides have same values, but the error is the same and that's because some IPSec Cookie doesn't flush correctly. In my experience, a good way to resolve this is create the tunnel again.

Hope it helps!

| improve this answer | |
  • What do you mean by "Maybe a keylife time in one side is 86400 and in the other side is 86400"? Are they not supposed to be the same value? I created both tunnels a numerous times and even tried different devices, what i'm trying to accomplish seems to be kind of special that is the reason i'm not asking for help to get the configuration straight but help to get the know how to debug and investigate this myself. Thank you anyway – F.H. Jul 14 '17 at 14:38
  • sorry, my mistake: – M4niac Jul 14 '17 at 14:55
  • i mean one side is 86400 and the another is different, like 8640 or any other number. Are they not supposed to be the same value? Yes, it does, but if you create the tunnel and made a mistake and type a different value, explaining this situation. The debug is saying this: The SA doesn't match (by a mistake in the config or an error in a temp cookie) but does't match, there's no other explanation, except one peer is malfuntioning. This link would help you: kb.fortinet.com/kb/documentLink.do?externalID=FD37383 – M4niac Jul 14 '17 at 15:01
1

For feature desperate searchers:
As it turned out the problem was not with the configuration settings but with the remote gateway type. After hours or even days of trying every combination and double and tripple checking the phase1 and phase2 parameters like keylife time, DH-group, etc. i got it working by changing the remote gateway type to dial-up (on one side). What cost me so much time was the strangeness of partially success in getting the site-2-site connection up, would it've failed before even connecting i might had looked earlier on other gateway types.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.