1

We have a site to site VPN connection to a branch office. Once in a while the connection drops for some reason and then we receive an error like this on the Fortigate 310b

ike Negotiate ISAKMP SA Error: ike 3:20b27f143b809b23/0000000000000000:0: no SA proposal chosen

It is a struggle to re-establish the connection, and I only manage it through trial and error. My question now is, how can I debug this further? I'm aware of the CLI command

diag debug application ike -1
diag debug enable

This gives me the above mentioned error, but this error seems to be thrown for a number of reasons, and I can't figure out for which one exactly. We already lost a lot of time with those problems, and I need to learn to debug and troubleshoot those issues to the core, otherwise I'm lost.

Any help greatly appreciated.

Improve this question
3
  • 1
    You should post more of your debug information. ISAKMP SA Error can mean many things.
    – user36472
    Jul 14, 2017 at 13:36
  • Exactly, ISAKMP SA Error can mean many things. How do i pin it down to the cause? I am asking for a deeper way of debugging, not getting THIS configuration right.
    – F.H.
    Jul 14, 2017 at 14:35
  • Well that is a problem we all face... Try and error would be my answer.
    – user36472
    Jul 14, 2017 at 16:25

3 Answers 3

Reset to default
1

no SA proposal chosen means that the security association doesn't match on both sides. Maybe a keylife time in one side is 86400 and in the other side is 86400.

You should post IKE phase 1 and phase2 from each fortigate.

Sometimes, in the config both sides have same values, but the error is the same and that's because some IPSec Cookie doesn't flush correctly. In my experience, a good way to resolve this is create the tunnel again.

Hope it helps!

Improve this answer
3
  • What do you mean by "Maybe a keylife time in one side is 86400 and in the other side is 86400"? Are they not supposed to be the same value? I created both tunnels a numerous times and even tried different devices, what i'm trying to accomplish seems to be kind of special that is the reason i'm not asking for help to get the configuration straight but help to get the know how to debug and investigate this myself. Thank you anyway
    – F.H.
    Jul 14, 2017 at 14:38
  • sorry, my mistake:
    – M4niac
    Jul 14, 2017 at 14:55
  • i mean one side is 86400 and the another is different, like 8640 or any other number. Are they not supposed to be the same value? Yes, it does, but if you create the tunnel and made a mistake and type a different value, explaining this situation. The debug is saying this: The SA doesn't match (by a mistake in the config or an error in a temp cookie) but does't match, there's no other explanation, except one peer is malfuntioning. This link would help you: kb.fortinet.com/kb/documentLink.do?externalID=FD37383
    – M4niac
    Jul 14, 2017 at 15:01
1

For future desperate searchers:
As it turned out the problem was not with the configuration settings but with the remote gateway type. After hours or even days of trying every combination and double and tripple checking the phase1 and phase2 parameters like keylife time, DH-group, etc. i got it working by changing the remote gateway type to dial-up (on one side). What cost me so much time was the strangeness of partially success in getting the site-2-site connection up, would it've failed before even connecting i might had looked earlier on other gateway types.

Improve this answer
0

Too late : yes. But just got chance to look at Fortigates and running a dialup server and client among them. Was failing saying negotitaion issues. Problem was on server end , selection was accepting peer by specific ID , which turns out to be case sensitive. When debug was ran with :

diag debug app ike -1

diag debug enable

-- ike 0::143: received peer identifier FQDN 'Remote-side'

Found out other side was responding with 'Remote-side' and my config on server side was 'Remote-Side'. So changed server end config to 'Remote-side'

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.