BFoIP ブログ

I was not able to connect Internet VPN between FortiGate and Juniper SRX.
Then I found following message at the FortiGate:
[peer has not completed Configuration Method]

---log messages------------- 

ike 0:VPNTest:890: notify msg received: R-U-THERE-ACK

ike 0:VPNTest:VPNTest: IPsec SA connect 4 10.10.10.1->192.168.1.1:0

ike 0:VPNTest:VPNTest: using existing connection

ike 0:VPNTest:VPNTest: config found

ike 0:VPNTest: request is on the queue

ike 0: comes 192.168.1.1:500->10.10.10.1:500,ifindex=4....

ike 0: IKEv1 exchange=Quick id=b8c9b865eb29f2bb/b31f2aadaac2cb72:efeabe21 len=428

ike 0: in B8C9B865EB29F2BBB31F2AADAAC2CB7208102001EFEABE21000001AC61F3DCE0A14CE2E5F756

ike 0:VPNTest:890: peer has not completed Configuration Method

ike 0:VPNTest: link is idle 4 10.10.10.1->192.168.1.1:0 dpd=1 seqno=2481

ike 0:VPNTest:890: send IKEv1 DPD probe, seqno 9345

ike 0:VPNTest:890: enc B8C9B865EB29F2BBB31F2AADAAC2CB7208100501A0EB31B500000054

ike 0:VPNTest:890: out B8C9B865EB29F2BBB31F2AADAAC2CB7208100501A0EB31B50000005C

ike 0:VPNTest:890: sent IKE msg (R-U-THERE): 10.10.10.1:500->192.168.1.1:500, len=92, id=b8c9b865eb29f2bb/b31f2aadaac2cb72:a0eb31b5

ike 0: comes 192.168.1.1:500->10.10.10.1:500,ifindex=4....

----------------

If you also find this message, please try to delete following configuration on your FortiGate firewall:
[set mode-cfg enable]


1. Enter "vpn ipsec phase1-interface" mode

Test-60C # config vpn ipsec phase1-interface


2. Check set mode-cfg enable is listed or not on your configuration using "show" command

Test-60C (phase1-interface) # show

config vpn ipsec phase1-interface

    edit "VPNTest"

        set interface "wan1"

        set nattraversal disable

        set mode-cfg enable

        set proposal 3des-sha1 aes128-sha1

        set dhgrp 5 2

        set remote-gw 192.168.1.1

        set psksecret ENC ooq9fO8Kc2/3JvXNaHzw==

    next

end


3. Delete "set mode-cfg enable"

Test-60C (phase1-interface) # edit VPNTest

Test-60C (VPNTest) # set mode-cfg disable


4. Confirm the configuration is deleted using show command

Test-60C (VPNTest) # show

config vpn ipsec phase1-interface

    edit "VPNTest"

        set interface "wan1"

        set nattraversal disable

        set proposal 3des-sha1 aes128-sha1

        set dhgrp 5 2

        set remote-gw 192.168.1.1

        set psksecret ENC ooq9fO8Kc2/3JvXNaHzw==

    next

end


5. Exit from the VPN configuration mode

Test-60C (VPNTest) # next

Test-60C (phase1-interface) # end

Test-60C # 

FortiGateとSRXでVPN接続を実施しようとした際、FortiGate側で

[peer has not completed Configuration Method]というメッセージでVPNが接続できなかったときの対応をメモしておきます。

---ログサンプル-------------

ike 0:VPNTest:890: notify msg received: R-U-THERE-ACK

ike 0:VPNTest:VPNTest: IPsec SA connect 4 10.10.10.1->192.168.1.1:0

ike 0:VPNTest:VPNTest: using existing connection

ike 0:VPNTest:VPNTest: config found

ike 0:VPNTest: request is on the queue

ike 0: comes 192.168.1.1:500->10.10.10.1:500,ifindex=4....

ike 0: IKEv1 exchange=Quick id=b8c9b865eb29f2bb/b31f2aadaac2cb72:efeabe21 len=428

ike 0: in B8C9B865EB29F2BBB31F2AADAAC2CB7208102001EFEABE21000001AC61F3DCE0A14CE2E5F756

ike 0:VPNTest:890: peer has not completed Configuration Method

ike 0:VPNTest: link is idle 4 10.10.10.1->192.168.1.1:0 dpd=1 seqno=2481

ike 0:VPNTest:890: send IKEv1 DPD probe, seqno 9345

ike 0:VPNTest:890: enc B8C9B865EB29F2BBB31F2AADAAC2CB7208100501A0EB31B500000054

ike 0:VPNTest:890: out B8C9B865EB29F2BBB31F2AADAAC2CB7208100501A0EB31B50000005C

ike 0:VPNTest:890: sent IKE msg (R-U-THERE): 10.10.10.1:500->192.168.1.1:500, len=92, id=b8c9b865eb29f2bb/b31f2aadaac2cb72:a0eb31b5

ike 0: comes 192.168.1.1:500->10.10.10.1:500,ifindex=4....

----------------

このメッセージが出た場合、[set mode-cfg enable]の設定を無効化にする必要がありました。


1.vpn ipsec phase1-interface の設定モードに入る

Test-60C # config vpn ipsec phase1-interface


2.show コマンドで set mode-cfg enable の設定の有無を確認

Test-60C (phase1-interface) # show

config vpn ipsec phase1-interface

    edit "VPNTest"

        set interface "wan1"

        set nattraversal disable

        set mode-cfg enable

        set proposal 3des-sha1 aes128-sha1

        set dhgrp 5 2

        set remote-gw 192.168.1.1

        set psksecret ENC ooq9fO8Kc2/3JvXNaHzw==

    next

end


3.set mode-cfg enable 設定の無効化

Test-60C (phase1-interface) # edit VPNTest

Test-60C (VPNTest) # set mode-cfg disable


4.showコマンドで、設定が無効化されたことを確認

 ※set mode-cfg enableが表示されないことを確認

Test-60C (VPNTest) # show

config vpn ipsec phase1-interface

    edit "VPNTest"

        set interface "wan1"

        set nattraversal disable

        set proposal 3des-sha1 aes128-sha1

        set dhgrp 5 2

        set remote-gw 192.168.1.1

        set psksecret ENC ooq9fO8Kc2/3JvXNaHzw==

    next

end


5.VPN設定モードから抜ける

Test-60C (VPNTest) # next

Test-60C (phase1-interface) # end

Test-60C # 

I have suffered from this issue for 2 weeks.

<Symptom>
Slow response or sometimes you can't access to Web pages when you use Symantec .cloud　Web Security Serivce.

I realized this issue on November 14th 2016 and I called to Symantec but, this issue isn't fixed yet.


<Current environment>
Out current environment is as follows:
PC --> domestic proxy server ---> Symantec .cloud Web Security Serivce ---> Web pages


<Isolate the cause>
To isolate the cause, I've done following case of connection test.

1. Full path test
PC --> domestic proxy server ---> Symantec .cloud Web Security Serivce ---> Web pages
Result: slow

2. Except the domestic proxy server
PC ---> Symantec .cloud Web Security Serivce ---> Web pages
Result: slow

3. Direct access to Web pages
PC ---> Web pages
Result: fast


From these results, the point of failure is Symantec .cloud Web Security Serivce.
I hope fix it as soon as possible!

In the network diagram above, which path will packets take when travelling from host 192.168.50.126 to host 192.168.50.5?
上記のネットワーク図で、192.168.50.126のホストから192.168.50.5のホストへ行く時、パケットはどのパスを通るでしょうか

A. Packets will travel from R3 to R2 to R1.
 R3 -> R2 -> R1を通る

B. Packets will travel from R1 to R3 to R2.
 R1 -> R3 -> R2を通る

C. Packets will travel from R3 to R1 and return back to R3.
 R3 -> R1 -> R3を通る

D, Packets will travel from R3 to R1 and from R3 to R2 to R1.
 R3 -> R1 と R3 -> R2 -> R1を通る

E. Packets will travel from R1 to R2 and back.
 R1 -> R2を通って戻る

CORRECT ANSWER - D

MORE INFORMATION:

We begin by identifying to which network host 192.168.50.126 belongs.
192.168.50.126がどのネットワークに属しているかを識別するところから始めます
*begin by ～で始める

IP address 192.168.50.126 is the last usable address for network 192.168.50.64/26, which means it is directly connected to router 3.
192.168.50.126のIPアドレスは192.168.50.64/26のネットワークで使用できる最後のアドレスで、それはルータ3に

直接接続されていることを意味しています。

Next, we need to identify where 192.168.50.5 is located.
次に、192.168.50.5がどこにあるのかを識別する必要があります。

By examining the diagram, we can see IP 192.168.50.5 is router 1's interface that connects directly with router 2.
ネットワーク図を調べると、192.168.50.5のIPアドレスはルータ2に直接接続されるルータ1のインタフェースにあることがわかります。

Finally, to understand the path packets will take, we examine the output of router 3's routing table and discover that there are two equal cost links to network 192.168.50.4/30, therefore EIGRP will load-balance between both paths.
最後に、パケットが通るパスを理解するために、ルータ3のルーティングテーブルの出力を調べると、ネットワーク 192.168.50.4/30に対する2つの等コストリンクがあることに気づきます。

従って、EIGRPは両方のパスで負荷分散をします。