Fortigate Cloud Firewall running on FortiOS Version 5. Is this supported by Palo Alto ?

[tac.in]

Hello All,

We would like to know whether the Fortigate Cloud Firewall running on FortiOS Version 5 is supported by PA for IPsec VPN as we are getting below error and tunnel is not coming up.

2015-03-17 10:53:28 [DEBUG]: vendorid.c:274:check_vendorid(): received unknown Vendor ID à Other End device is a Fortigate Cloud Firewall running on FortiOS Version 5. Is this supported by Palo Alto ?

2015-03-17 10:53:28 [DEBUG]: ipsec_doi.c:283:get_ph1approval(): an acceptable proposal found.

2015-03-17 10:53:28 [DEBUG]: ikev1.c:1672:isakmp_ph1resend(): resend phase1 packet 24871bfed0152c7e:faab2d4faea77d3f

2015-03-17 10:53:34 [INFO]: ikev1.c:318:ikev1_main(): the packet is retransmitted by 40.132.56.196[500]

2015-03-17 10:53:46 [DEBUG]: ikev1.c:1672:isakmp_ph1resend(): resend phase1 packet 24871bfed0152c7e:faab2d4faea77d3f

2015-03-17 10:53:49 [PROTO_NOTIFY]: ikev1.c:2423:log_ph1negofailed(): ====> PHASE-1 NEGOTIATION FAILED AS RESPONDER, MAIN MODE <====

====> Failed SA: 117.239.143.210[500]-40.132.56.196[500] cookie:0f9f6a98fdcb36ec:807e1f8d23119dee <==== Due to timeout.

2015-03-17 10:53:49 [INFO]: ikev1.c:2471:log_ph1deleted(): ====> PHASE-1 SA DELETED <====

====> Deleted SA: 117.239.143.210[500]-40.132.56.196[500] cookie:0f9f6a98fdcb36ec:807e1f8d23119dee <====

Thanks.

[hshah]

Hello TAC,

Error "received unknown Vendor ID" doesn't mean peer is not supported for VPN, it appears to be a different issue.

I would suggest to open a case with TAC.

Regards,

Hardik Shah

[hshah]

Can you also check VPN related session, check if any of the session in Discard state. This might be a policy related issue, where traffic is blocked by policy.

[pulukas]

Based on the logs here you should check these two settings.

Preshared key: confirm this is the same on both devices

Phase one crypto packages: confirm these are the same on both devices

These are configured on the Palo Alto at

Network tab -- Network profiles-- IKE Gateway

The crypto options are created

Network tab--Network profiles--IKE Crypto

The default Cryto package settings are

Group 2;  AES or 3DES; SHA1 and 8 hours lifetime