<div>Thank you for the clarification.</div><div><br><div class="gmail_quote"><div>On Fri, 11 May 2018 at 22:00, Noel Kuntze <noel.kuntze+strongswan-users-ml@thermi.consulting> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello,<br>
<br>
The Fortigate behaves incorrectly.<br>
It is incorrect to send packets with NON-ESP markers to port 500. The Fortigate needs to send those packets to port 4500 after faking a NAT situation to force the usage of UDP encapsulation.<br>
It did not do that.<br>
<br>
Kind regards<br>
<br>
Noel<br>
<br>
On 11.05.2018 12:14, André Cruz wrote:<br>
> Hello.<br>
><br>
> I've managed to fix the problem which was related to the usage of different ports. StrongSwan was sending a request from port 500 to port 500, Fortigate is answering from port 4500 which has an ESP marker, and so StrognSwan was reading the protocol version in the wrong place.<br>
><br>
> leftikeport = 4500<br>
> rightikeport = 4500<br>
><br>
> managed to fix this.<br>
><br>
> Best regards,<br>
> André<br>
><br>
>> On 10 May 2018, at 22:11, André Cruz <<a href="mailto:andre@cabine.org" target="_blank">andre@cabine.org</a>> wrote:<br>
>><br>
>> Hello.<br>
>><br>
>> I’m trying to establish a VPN (IKEv1) with a Fortigate peer and I’m having some difficulties. I’m sure this has worked in the past, however now I’m getting a strange error back.<br>
>><br>
>> This is the StringSwan log:<br>
>><br>
>> ipsec_starter[5409]: Starting strongSwan 5.6.2 IPsec [starter]…<br>
>> …<br>
>> charon[5424]: 06[IKE] queueing ISAKMP_VENDOR task<br>
>> charon[5424]: 06[IKE] queueing ISAKMP_CERT_PRE task<br>
>> charon[5424]: 06[IKE] queueing MAIN_MODE task<br>
>> charon[5424]: 06[IKE] queueing ISAKMP_CERT_POST task<br>
>> charon[5424]: 06[IKE] queueing ISAKMP_NATD task<br>
>> charon[5424]: 06[IKE] queueing QUICK_MODE task<br>
>> charon[5424]: 06[IKE] activating new tasks<br>
>> charon[5424]: 06[IKE] activating ISAKMP_VENDOR task<br>
>> charon[5424]: 06[IKE] activating ISAKMP_CERT_PRE task<br>
>> charon[5424]: 06[IKE] activating MAIN_MODE task<br>
>> charon[5424]: 06[IKE] activating ISAKMP_CERT_POST task<br>
>> charon[5424]: 06[IKE] activating ISAKMP_NATD task<br>
>> charon[5424]: 06[IKE] sending XAuth vendor ID<br>
>> charon[5424]: 06[IKE] sending DPD vendor ID<br>
>> charon[5424]: 06[IKE] sending FRAGMENTATION vendor ID<br>
>> charon[5424]: 06[IKE] sending NAT-T (RFC 3947) vendor ID<br>
>> charon[5424]: 06[IKE] sending draft-ietf-ipsec-nat-t-ike-02\n vendor ID<br>
>> charon[5424]: 06[IKE] initiating Main Mode IKE_SA ama[1] to (FORTIGATE)<br>
>> charon[5424]: 06[IKE] initiating Main Mode IKE_SA ama[1] to (FORTIGATE)<br>
>> charon[5424]: 06[IKE] IKE_SA ama[1] state change: CREATED => CONNECTING<br>
>> charon[5424]: 06[ENC] generating ID_PROT request 0 [ SA V V V V V ]<br>
>> charon[5424]: 06[NET] sending packet: from 10.132.0.2[500] to (FORTIGATE)[500] (184 bytes)<br>
>> charon[5424]: 03[ENC] generating INFORMATIONAL response 0 [ N(INVAL_MAJOR) ]<br>
>> charon[5424]: 03[NET] sending packet: from 10.132.0.2[500] to (FORTIGATE)[4500] (36 bytes)<br>
>> charon[5424]: 03[NET] received unsupported IKE version 9.9 from (FORTIGATE), sending INVALID_MAJOR_VERSION<br>
>><br>
>><br>
>> This is a pcap interpretation of the first 3 packets of the VPN attempt:<br>
>><br>
>><br>
>> SSwan port 500 -> Fortigate port 500<br>
>> Internet Security Association and Key Management Protocol<br>
>> Initiator SPI: 15fdb0398dcc1262<br>
>> Responder SPI: 0000000000000000<br>
>> Next payload: Security Association (1)<br>
>> Version: 1.0<br>
>> 0001 .... = MjVer: 0x1<br>
>> .... 0000 = MnVer: 0x0<br>
>> Exchange type: Identity Protection (Main Mode) (2)<br>
>> Flags: 0x00<br>
>> .... ...0 = Encryption: Not encrypted<br>
>> .... ..0. = Commit: No commit<br>
>> .... .0.. = Authentication: No authentication<br>
>> Message ID: 0x00000000<br>
>> Length: 184<br>
>> Type Payload: Security Association (1)<br>
>> Next payload: Vendor ID (13)<br>
>> Payload length: 60<br>
>> Domain of interpretation: IPSEC (1)<br>
>> Situation: 00000001<br>
>> .... .... .... .... .... .... .... ...1 = Identity Only: True<br>
>> .... .... .... .... .... .... .... ..0. = Secrecy: False<br>
>> .... .... .... .... .... .... .... .0.. = Integrity: False<br>
>> Type Payload: Proposal (2) # 0<br>
>> Next payload: NONE / No Next Payload (0)<br>
>> Payload length: 48<br>
>> Proposal number: 0<br>
>> Protocol ID: ISAKMP (1)<br>
>> SPI Size: 0<br>
>> Proposal transforms: 1<br>
>> Type Payload: Transform (3) # 1<br>
>> Next payload: NONE / No Next Payload (0)<br>
>> Payload length: 40<br>
>> Transform number: 1<br>
>> Transform ID: KEY_IKE (1)<br>
>> Transform IKE Attribute Type (t=1,l=2) Encryption-Algorithm : AES-CBC<br>
>> 1... .... .... .... = Transform IKE Format: Type/Value (TV)<br>
>> Transform IKE Attribute Type: Encryption-Algorithm (1)<br>
>> Value: 0007<br>
>> Encryption Algorithm: AES-CBC (7)<br>
>> Transform IKE Attribute Type (t=14,l=2) Key-Length : 256<br>
>> 1... .... .... .... = Transform IKE Format: Type/Value (TV)<br>
>> Transform IKE Attribute Type: Key-Length (14)<br>
>> Value: 0100<br>
>> Key Length: 256<br>
>> Transform IKE Attribute Type (t=2,l=2) Hash-Algorithm : SHA2-256<br>
>> 1... .... .... .... = Transform IKE Format: Type/Value (TV)<br>
>> Transform IKE Attribute Type: Hash-Algorithm (2)<br>
>> Value: 0004<br>
>> HASH Algorithm: SHA2-256 (4)<br>
>> Transform IKE Attribute Type (t=4,l=2) Group-Description : 2048 bit MODP group<br>
>> 1... .... .... .... = Transform IKE Format: Type/Value (TV)<br>
>> Transform IKE Attribute Type: Group-Description (4)<br>
>> Value: 000e<br>
>> Group Description: 2048 bit MODP group (14)<br>
>> Transform IKE Attribute Type (t=3,l=2) Authentication-Method : PSK<br>
>> 1... .... .... .... = Transform IKE Format: Type/Value (TV)<br>
>> Transform IKE Attribute Type: Authentication-Method (3)<br>
>> Value: 0001<br>
>> Authentication Method: PSK (1)<br>
>> Transform IKE Attribute Type (t=11,l=2) Life-Type : Seconds<br>
>> 1... .... .... .... = Transform IKE Format: Type/Value (TV)<br>
>> Transform IKE Attribute Type: Life-Type (11)<br>
>> Value: 0001<br>
>> Life Type: Seconds (1)<br>
>> Transform IKE Attribute Type (t=12,l=4) Life-Duration : 86400<br>
>> 0... .... .... .... = Transform IKE Format: Type/Length/Value (TLV)<br>
>> Transform IKE Attribute Type: Life-Duration (12)<br>
>> Length: 4<br>
>> Value: 00015180<br>
>> Life Duration: 86400<br>
>> Type Payload: Vendor ID (13) : XAUTH<br>
>> Next payload: Vendor ID (13)<br>
>> Payload length: 12<br>
>> Vendor ID: 09002689dfd6b712<br>
>> Vendor ID: XAUTH<br>
>> Type Payload: Vendor ID (13) : RFC 3706 DPD (Dead Peer Detection)<br>
>> Next payload: Vendor ID (13)<br>
>> Payload length: 20<br>
>> Vendor ID: afcad71368a1f1c96b8696fc77570100<br>
>> Vendor ID: RFC 3706 DPD (Dead Peer Detection)<br>
>> Type Payload: Vendor ID (13) : Cisco Fragmentation<br>
>> Next payload: Vendor ID (13)<br>
>> Payload length: 24<br>
>> Vendor ID: 4048b7d56ebce88525e7de7f00d6c2d380000000<br>
>> Vendor ID: Cisco Fragmentation<br>
>> Type Payload: Vendor ID (13) : RFC 3947 Negotiation of NAT-Traversal in the IKE<br>
>> Next payload: Vendor ID (13)<br>
>> Payload length: 20<br>
>> Vendor ID: 4a131c81070358455c5728f20e95452f<br>
>> Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE<br>
>> Type Payload: Vendor ID (13) : draft-ietf-ipsec-nat-t-ike-02\n<br>
>> Next payload: NONE / No Next Payload (0)<br>
>> Payload length: 20<br>
>> Vendor ID: 90cb80913ebb696e086381b5ec427b1f<br>
>> Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n<br>
>><br>
>><br>
>> Fortigate port 4500 -> SSwan 500<br>
>> Internet Security Association and Key Management Protocol<br>
>> Initiator SPI: 15fdb0398dcc1262<br>
>> Responder SPI: 88f25e0e3299ec3c<br>
>> Next payload: Security Association (1)<br>
>> Version: 1.0<br>
>> 0001 .... = MjVer: 0x1<br>
>> .... 0000 = MnVer: 0x0<br>
>> Exchange type: Identity Protection (Main Mode) (2)<br>
>> Flags: 0x00<br>
>> .... ...0 = Encryption: Not encrypted<br>
>> .... ..0. = Commit: No commit<br>
>> .... .0.. = Authentication: No authentication<br>
>> Message ID: 0x00000000<br>
>> Length: 148<br>
>> Type Payload: Security Association (1)<br>
>> Next payload: Vendor ID (13)<br>
>> Payload length: 60<br>
>> Domain of interpretation: IPSEC (1)<br>
>> Situation: 00000001<br>
>> .... .... .... .... .... .... .... ...1 = Identity Only: True<br>
>> .... .... .... .... .... .... .... ..0. = Secrecy: False<br>
>> .... .... .... .... .... .... .... .0.. = Integrity: False<br>
>> Type Payload: Proposal (2) # 0<br>
>> Next payload: NONE / No Next Payload (0)<br>
>> Payload length: 48<br>
>> Proposal number: 0<br>
>> Protocol ID: ISAKMP (1)<br>
>> SPI Size: 0<br>
>> Proposal transforms: 1<br>
>> Type Payload: Transform (3) # 1<br>
>> Next payload: NONE / No Next Payload (0)<br>
>> Payload length: 40<br>
>> Transform number: 1<br>
>> Transform ID: KEY_IKE (1)<br>
>> Transform IKE Attribute Type (t=1,l=2) Encryption-Algorithm : AES-CBC<br>
>> 1... .... .... .... = Transform IKE Format: Type/Value (TV)<br>
>> Transform IKE Attribute Type: Encryption-Algorithm (1)<br>
>> Value: 0007<br>
>> Encryption Algorithm: AES-CBC (7)<br>
>> Transform IKE Attribute Type (t=14,l=2) Key-Length : 256<br>
>> 1... .... .... .... = Transform IKE Format: Type/Value (TV)<br>
>> Transform IKE Attribute Type: Key-Length (14)<br>
>> Value: 0100<br>
>> Key Length: 256<br>
>> Transform IKE Attribute Type (t=2,l=2) Hash-Algorithm : SHA2-256<br>
>> 1... .... .... .... = Transform IKE Format: Type/Value (TV)<br>
>> Transform IKE Attribute Type: Hash-Algorithm (2)<br>
>> Value: 0004<br>
>> HASH Algorithm: SHA2-256 (4)<br>
>> Transform IKE Attribute Type (t=4,l=2) Group-Description : 2048 bit MODP group<br>
>> 1... .... .... .... = Transform IKE Format: Type/Value (TV)<br>
>> Transform IKE Attribute Type: Group-Description (4)<br>
>> Value: 000e<br>
>> Group Description: 2048 bit MODP group (14)<br>
>> Transform IKE Attribute Type (t=3,l=2) Authentication-Method : PSK<br>
>> 1... .... .... .... = Transform IKE Format: Type/Value (TV)<br>
>> Transform IKE Attribute Type: Authentication-Method (3)<br>
>> Value: 0001<br>
>> Authentication Method: PSK (1)<br>
>> Transform IKE Attribute Type (t=11,l=2) Life-Type : Seconds<br>
>> 1... .... .... .... = Transform IKE Format: Type/Value (TV)<br>
>> Transform IKE Attribute Type: Life-Type (11)<br>
>> Value: 0001<br>
>> Life Type: Seconds (1)<br>
>> Transform IKE Attribute Type (t=12,l=4) Life-Duration : 86400<br>
>> 0... .... .... .... = Transform IKE Format: Type/Length/Value (TLV)<br>
>> Transform IKE Attribute Type: Life-Duration (12)<br>
>> Length: 4<br>
>> Value: 00015180<br>
>> Life Duration: 86400<br>
>> Type Payload: Vendor ID (13) : RFC 3947 Negotiation of NAT-Traversal in the IKE<br>
>> Next payload: Vendor ID (13)<br>
>> Payload length: 20<br>
>> Vendor ID: 4a131c81070358455c5728f20e95452f<br>
>> Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE<br>
>> Type Payload: Vendor ID (13) : RFC 3706 DPD (Dead Peer Detection)<br>
>> Next payload: Vendor ID (13)<br>
>> Payload length: 20<br>
>> Vendor ID: afcad71368a1f1c96b8696fc77570100<br>
>> Vendor ID: RFC 3706 DPD (Dead Peer Detection)<br>
>> Type Payload: Vendor ID (13) : Unknown Vendor ID<br>
>> Next payload: NONE / No Next Payload (0)<br>
>> Payload length: 20<br>
>> Vendor ID: 8299031757a36082c6a621de000402b6<br>
>> Vendor ID: Unknown Vendor ID<br>
>><br>
>><br>
>> SSwan port 500 -> Fortigate port 4500<br>
>> Internet Security Association and Key Management Protocol<br>
>> Initiator SPI: 0000000015fdb039<br>
>> Responder SPI: 8dcc126288f25e0e<br>
>> Next payload: Notify (41)<br>
>> Version: 2.0<br>
>> 0010 .... = MjVer: 0x2<br>
>> .... 0000 = MnVer: 0x0<br>
>> Exchange type: INFORMATIONAL (37)<br>
>> Flags: 0x20 (Responder, No higher version, Response)<br>
>> .... 0... = Initiator: Responder<br>
>> ...0 .... = Version: No higher version<br>
>> ..1. .... = Response: Response<br>
>> Message ID: 0x00000000<br>
>> Length: 36<br>
>> Type Payload: Notify (41) - INVALID_MAJOR_VERSION<br>
>> Next payload: NONE / No Next Payload (0)<br>
>> 0... .... = Critical Bit: Not Critical<br>
>> Payload length: 8<br>
>> Protocol ID: RESERVED (0)<br>
>> SPI Size: 0<br>
>> Notify Message Type: INVALID_MAJOR_VERSION (5)<br>
>> Notification DATA: <MISSING><br>
>><br>
>><br>
>> Can anyone explain why the INVALID_MAJOR_VERSION error?<br>
>><br>
>> This is the config I’m using:<br>
>><br>
>> config setup<br>
>> charondebug="ike 2, knl 3, cfg 0"<br>
>> uniqueids = yes<br>
>><br>
>> conn ama<br>
>> keyexchange = ikev1<br>
>> right = (FORTIGATE)<br>
>> rightid = (FORTIGATE)<br>
>> rightsubnet = <a href="http://172.31.200.0/23" rel="noreferrer" target="_blank">172.31.200.0/23</a><br>
>> rightauth = psk<br>
>> left = 10.132.0.2<br>
>> leftid = (MYIP)<br>
>> leftsubnet = <a href="http://172.31.229.240/29" rel="noreferrer" target="_blank">172.31.229.240/29</a><br>
>> leftauth = psk<br>
>> auto = start<br>
>> esp = aes256-sha256-modp2048!<br>
>> ike = aes256-sha256-modp2048!<br>
>> type = tunnel<br>
>> ikelifetime = 24h<br>
>> lifetime = 1h<br>
>> dpdaction = restart<br>
>> forceencaps = yes<br>
>><br>
>> Thank you for the help!<br>
>><br>
>> Best regards,<br>
>> André<br>
<br>
</blockquote></div></div>