VPN S2S Fortigate vs CISCO received: NO-PROPOSAL-CHOSEN

[dcrosio]

Hola,

Estoy teniendo un problema en la configuración de una VPN S2S entre mi FG1000C y un CISCO 2900

arroja error "notify msg received: NO-PROPOSAL-CHOSEN"

config vpn ipsec phase1-interface
edit "VPN-PALPALA"
set interface "wan2"
set keylife 28800
set proposal 3des-sha256
set dpd disable
set comments "VPN: VPN-PALPALA (Created by VPN wizard)"
set dhgrp 2
set remote-gw ---.---.---.---
set psksecret ENC dmFyLx9GWg8MMm3VDiiS80ZSeMsr5NxfWHRCM2+izwM5KPC9lfYTjWc9ZHCXx2NPWZhgeg3dnBlplXyFUTI5abJEQBz8J2wYPxi4Hicn4mc4xOKmh3n2+hGx9biemkbu8YXiZTK7OFSc0nON7StgoJs+r50ljmiOmtR8Mh5fhgmunR2wNZ4aGIAcU2Tz2CFcbonpjQ==
next
end

config vpn ipsec phase2-interface
edit "VPN-PALPALA"
set phase1name "VPN-PALPALA"
set proposal 3des-sha1
set dhgrp 5
set auto-negotiate enable
set comments "VPN: VPN-PALPALA (Created by VPN wizard)"
set keylifeseconds 28800
set src-subnet 186.33.209.0 255.255.255.0
set dst-subnet 192.168.6.0 255.255.255.0
next
end

-------------------------------- CISCO --------------------------------------------


crypto isakmp policy 10
encr 3des
hash sha256
authentication pre-share
group 5
crypto isakmp key Modern address ---.---.---.---
!
!
crypto ipsec transform-set TRANSF ah-sha-hmac esp-3des
mode tunnel
!
!
!
crypto map VPN-MAP 1 ipsec-isakmp
set peer ---.---.---.---
set security-association lifetime seconds 28800
set transform-set TRANSF
set pfs group5
match address VPN-TRAFFIC

-----------------------------------------------------------------------------------------------------

ike 0: IKEv1 exchange=Informational id=08e595639091443f/33877b3a3b78557b:2734ccb9 len=100
ike 0: in 08E595639091443F33877B3A3B78557B081005012734CCB900000064DDB8FC72B55BE78373107A62B825FDDAE12FE41FD3C39A0603317F8D9A16B12009752C254F067ED31A6E9C3FA6428E77662918798DD21B2C7D55EB0D3DC22485543357C559CC50AE
ike 0:VPN-PALPALA:422891: dec 08E595639091443F33877B3A3B78557B081005012734CCB9000000640B000024A6283585C471F5339F944082B636F9114FDB619C67043149F940CCAA49DC7DC00000001C000000010304000EF9A207870A00003400000001000000010000000000000000
ike 0:VPN-PALPALA:422891: notify msg received: NO-PROPOSAL-CHOSEN
ike 0:VPN-PALPALA:422891:VPN-PALPALA:7515254: IPsec SPI f9a20787 match
ike 0:VPN-PALPALA:422891:VPN-PALPALA:7515254: delete phase2 SPI f9a20787

[gabyrossi]

hola, revisa bien el dhgrp

[dcrosio]

Hola,

Gracias por tu respuesta, encontramos el problema y solucionamos el tema "túnel".
Ya levanta el túnel pero no conseguimos cursar trafico.
Creo que me falta algo en el CISCO pero no logro descubrir que es.

Saludos

Daniel

[gabyrossi]

hola, vos ves trafico que pasa por tu poltiica de vpn?

[moler]

En que sentido es el trafico?

En forti hiciste las politicas?
En el cisco, hiciste las reglas ? (siempre que el sentido sea del lado del cisco al forti, tienes que hacer las reglas en la "inside" o interfaz que corresponda.
Fijate de hacer un diagnose sniffer en el forti, genera trafico y comprueba el comportamiento.