<html><head></head><body><div class="ydpc6d51047yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr" data-setdir="false"><div>Hi<br><br>I am trying to configure a VPN tunnel between a Linux VM in Azure with a customer's Fortigate firewall. The Azure VM is behind an Azure load balancer, so has a different public IP from the local VM IP. The good news is that the configuration is working with PSK. However, when trying to use certificate-based authentication, the connection is not establishing. I can see the connection request coming in from the customer, but it fails to complete.<br><br>I am not sure what the "id" values should be for a Fortigate when using certificates. I have tried: IP address, FQDN, and Distinguished Name, but none appear to be working. We have tried using a third party "proper" certificate, and also a self-signed certificate (the below is based on the self-signed certificate. Both ends have the same self-signed/created CA root certificate installed).<br><br>Please see the logs and command outputs below. customer name and IPs have been sanitized.<br><br>Version: 5.6.2-1ubuntu2.4 (latest available on Ubuntu 18.04.2 LTS<br><br>Any help would be appreciated! We have spent three days trying to debug this without success.<br><br>Thanks<br><br>Julian<br><br><br>The output of swanctl -l:<br><br>(unnamed): #1, CONNECTING, IKEv2, d97222f0d8c960ed_i 4f771e61521bd11a_r*<br> local '%any' @ 172.26.0.85[500]<br> remote '%any' @ 123.123.123.123[500]<br> AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048<br> passive: IKE_CERT_PRE IKE_AUTH IKE_CERT_POST IKE_CONFIG CHILD_CREATE IKE_AUTH_LIFETIME IKE_MOBIKE<br><br>The output of swanctl -L:<br>customername: IKEv2, no reauthentication, rekeying every 14400s<br> local: 172.26.0.85<br> remote: 123.123.123.123<br> local public key authentication:<br> id: vpnrsa-ss.production.onecloud.companyname.cloud<br> certs: C=GB, ST=County, O=CompanyName, OU=Technical Services, CN=vpnrsa-ss.production.onecloud.companyname.cloud<br> remote public key authentication:<br> id: vpn1.customername.gov.uk<br> datacentre-customername: TUNNEL, rekeying every 3600s or 4608000 bytes<br> local: 172.26.0.85/32 172.16.16.64/27 172.16.44.32/28 172.16.60.0/22 172.16.30.196/32<br> remote: 10.10.8.1/32 10.10.8.2/32 10.10.8.22/32 10.10.8.23/32 10.10.8.24/32 10.10.8.25/32 10.10.8.45/32<br><br><br>The output of iptables -L:<br><br>Chain INPUT (policy ACCEPT)<br>target prot opt source destination<br><br>Chain FORWARD (policy ACCEPT)<br>target prot opt source destination<br><br>Chain OUTPUT (policy ACCEPT)<br>target prot opt source destination<br><br>The output of ip route show table all:<br><br>10.10.8.1 via 172.26.0.81 dev eth0 table 220 proto static src 172.26.0.85<br>10.10.8.2 via 172.26.0.81 dev eth0 table 220 proto static src 172.26.0.85<br>10.10.8.22 via 172.26.0.81 dev eth0 table 220 proto static src 172.26.0.85<br>10.10.8.23 via 172.26.0.81 dev eth0 table 220 proto static src 172.26.0.85<br>10.10.8.24 via 172.26.0.81 dev eth0 table 220 proto static src 172.26.0.85<br>10.10.8.25 via 172.26.0.81 dev eth0 table 220 proto static src 172.26.0.85<br>10.10.8.45 via 172.26.0.81 dev eth0 table 220 proto static src 172.26.0.85<br>default via 172.26.0.81 dev eth0 proto dhcp src 172.26.0.85 metric 100<br>168.63.129.16 via 172.26.0.81 dev eth0 proto dhcp src 172.26.0.85 metric 100<br>169.254.169.254 via 172.26.0.81 dev eth0 proto dhcp src 172.26.0.85 metric 100<br>172.26.0.80/28 dev eth0 proto kernel scope link src 172.26.0.85<br>broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1<br>local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1<br>local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1<br>broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1<br>broadcast 172.26.0.80 dev eth0 table local proto kernel scope link src 172.26.0.85<br>local 172.26.0.85 dev eth0 table local proto kernel scope host src 172.26.0.85<br>broadcast 172.26.0.95 dev eth0 table local proto kernel scope link src 172.26.0.85<br>::1 dev lo proto kernel metric 256 pref medium<br>fe80::/64 dev eth0 proto kernel metric 256 pref medium<br>local ::1 dev lo table local proto kernel metric 0 pref medium<br>local fe80::20d:3aff:fe7e:9150 dev eth0 table local proto kernel metric 0 pref medium<br>ff00::/8 dev eth0 table local metric 256 pref medium<br><br>The output of ip addr:<br>1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000<br> link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00<br> inet 127.0.0.1/8 scope host lo<br> valid_lft forever preferred_lft forever<br> inet6 ::1/128 scope host<br> valid_lft forever preferred_lft forever<br>2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000<br> link/ether 00:0d:3a:7e:91:50 brd ff:ff:ff:ff:ff:ff<br> inet 172.26.0.85/28 brd 172.26.0.95 scope global eth0<br> valid_lft forever preferred_lft forever<br> inet6 fe80::20d:3aff:fe7e:9150/64 scope link<br> valid_lft forever preferred_lft forever<br><br><br>The only configuration file change I have made is to create a customername.conf file in /etc/swanctl/conf.d with the following:<br><br># customername<br>connections {<br><br> customername {<br> local_addrs = 172.26.0.85<br> remote_addrs = 123.123.123.123<br><br> local {<br> #auth = psk<br> #id = 172.26.0.85<br><br> auth = pubkey<br> id = vpnrsa-ss.production.onecloud.companyname.cloud<br> certs = strongswan_self_signed2.crt<br> #id = "C=GB, ST=London, L=London, O=CompanyName PLC, CN=vpnrsa.production.onecloud.companyname.cloud"<br> }<br> remote {<br> auth = psk<br> #id = 123.123.123.123<br> id = vpn1.customername.gov.uk<br> #auth = pubkey<br> #id = "C=GB, S=customername, L=Town, O=customername County Council, OU=customername County Council, CN=vpn1.customername.gov.uk"<br> #id = "C=GB, ST=County, O=CompanyName, OU=Technical Services, CN=vpn1.customername.gov.uk"<br> }<br> children {<br> datacentre-customername {<br> local_ts = 172.26.0.85,172.16.16.64/27,172.16.44.32/28,172.16.60.0/22,172.16.30.196/32<br> remote_ts = 10.10.8.1,10.10.8.2,10.10.8.22,10.10.8.23,10.10.8.24,10.10.8.25,10.10.8.45<br> dpd_action = restart<br> start_action = trap<br> rekey_bytes = 4608000<br> esp_proposals = aes256-sha256-modp2048 #phase 2<br> }<br> }<br> version = 2<br> mobike = no<br> proposals = aes256-sha256-modp2048 #phase 1 customername proposed<br> }<br>}<br><br>secrets {<br> ike-customername {<br> id = 172.26.0.85<br> secret = <snipped><br> }<br> ike-customer2 {<br> id = 123.123.123.123<br> secret = <snipped><br> }<br> ike-customer3 {<br> id = vpn1.customername.gov.uk<br> secret = <snipped><br> }<br>}</div><div><br></div></div></div></body></html>