Fortigate Cloud Firewall running on FortiOS Version 5. Is this supported by Palo Alto ?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Fortigate Cloud Firewall running on FortiOS Version 5. Is this supported by Palo Alto ?

L3 Networker


Hello All,


We would like to know whether the Fortigate Cloud Firewall running on FortiOS Version 5 is supported by PA for IPsec VPN as we are getting below error and tunnel is not coming up.


2015-03-17 10:53:28 [DEBUG]: vendorid.c:274:check_vendorid(): received unknown Vendor ID à Other End device is a Fortigate Cloud Firewall running on FortiOS Version 5. Is this supported by Palo Alto ?

2015-03-17 10:53:28 [DEBUG]: ipsec_doi.c:283:get_ph1approval(): an acceptable proposal found.

2015-03-17 10:53:28 [DEBUG]: ikev1.c:1672:isakmp_ph1resend(): resend phase1 packet 24871bfed0152c7e:faab2d4faea77d3f

2015-03-17 10:53:34 [INFO]: ikev1.c:318:ikev1_main(): the packet is retransmitted by 40.132.56.196[500]

2015-03-17 10:53:46 [DEBUG]: ikev1.c:1672:isakmp_ph1resend(): resend phase1 packet 24871bfed0152c7e:faab2d4faea77d3f

2015-03-17 10:53:49 [PROTO_NOTIFY]: ikev1.c:2423:log_ph1negofailed(): ====> PHASE-1 NEGOTIATION FAILED AS RESPONDER, MAIN MODE <====

====> Failed SA: 117.239.143.210[500]-40.132.56.196[500] cookie:0f9f6a98fdcb36ec:807e1f8d23119dee <==== Due to timeout.

2015-03-17 10:53:49 [INFO]: ikev1.c:2471:log_ph1deleted(): ====> PHASE-1 SA DELETED <====

====> Deleted SA: 117.239.143.210[500]-40.132.56.196[500] cookie:0f9f6a98fdcb36ec:807e1f8d23119dee <====


Thanks.

3 REPLIES 3

L6 Presenter

Hello TAC,

Error "received unknown Vendor ID" doesn't mean peer is not supported for VPN, it appears to be a different issue.

I would suggest to open a case with TAC.

Regards,

Hardik Shah

L6 Presenter

Can you also check VPN related session, check if any of the session in Discard state. This might be a policy related issue, where traffic is blocked by policy.

L7 Applicator

Based on the logs here you should check these two settings.

Preshared key: confirm this is the same on both devices

Phase one crypto packages: confirm these are the same on both devices

These are configured on the Palo Alto at

Network tab -- Network profiles-- IKE Gateway

The crypto options are created

Network tab--Network profiles--IKE Crypto

The default Cryto package settings are

Group 2;  AES or 3DES; SHA1 and 8 hours lifetime

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center
  • 2035 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!