0

I'm attempting to get a Linux (Debian 10.10) client VPN'ing to a Fortigate server.

This is apparently not that well explored.

There's this document: https://kb.fortinet.com/kb/documentLink.do?externalID=11835 ...which I've been basing my work on, but I'm still getting:

STATE_PARENT_I1: 60 second timeout exceeded after 7 retransmits.  No response (or no acceptable response) to our first IKEv2 message

Or more specifically:

002 "officelan": deleting non-instance connection
002 "officelan" #10: deleting state (STATE_PARENT_I1) and NOT sending notification
002 added connection description "officelan"
002 "officelan" #11: initiating v2 parent SA
133 "officelan" #11: initiate
002 "officelan" #11: constructed local IKE proposals for officelan (IKE SA initiator selecting KE): 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_256;INTEG=NONE;DH=MODP2048
133 "officelan" #11: STATE_PARENT_I1: sent v2I1, expected v2R1
010 "officelan" #11: STATE_PARENT_I1: retransmission; will wait 0.5 seconds for response
010 "officelan" #11: STATE_PARENT_I1: retransmission; will wait 1 seconds for response
010 "officelan" #11: STATE_PARENT_I1: retransmission; will wait 2 seconds for response
010 "officelan" #11: STATE_PARENT_I1: retransmission; will wait 4 seconds for response
010 "officelan" #11: STATE_PARENT_I1: retransmission; will wait 8 seconds for response
010 "officelan" #11: STATE_PARENT_I1: retransmission; will wait 16 seconds for response
010 "officelan" #11: STATE_PARENT_I1: retransmission; will wait 32 seconds for response
031 "officelan" #11: STATE_PARENT_I1: 60 second timeout exceeded after 7 retransmits.  No response (or no acceptable response) to our first IKEv2 message
000 "officelan" #11: starting keying attempt 2 of an unlimited number, but releasing whack

I'm using these commands to obtain the above:

systemctl start ipsec.service
/usr/sbin/ipsec auto --add officelan
/usr/sbin/ipsec auto --up officelan

My /etc/ipsec.d/officelan.conf looks like:

conn officelan
    rekey=yes
    rightid=officelan
    left=192.168.1.101
    leftsubnet=192.168.1.0/24
    right=<redacted-ip-address>
    rightsubnet=172.40.0.0/24
    ikelifetime=28800s
    authby=secret
    type=tunnel
    auto=start
    ike=aes_gcm256-sha2
    esp=aes_gcm256-null
    ikev2=insist
    fragmentation=yes
    #perfect forward secrecy (default yes)
    #pfs=no
    #optionally enable compression
    compress=yes

And my /etc/ipsec.d/officelan.secrets looks like:

host.example.com %any : PSK "bigrandomsecret"

I don't really know if this is relevant or not, but ike-scan doesn't like the server:

$ ike-scan ip-of-server.example.com
below cmd output started 2021 Wed Jul 07 03:50:45 PM PDT
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)

Ending ike-scan 1.9.4: 1 hosts scanned in 2.443 seconds (0.41 hosts/sec).  0 returned handshake; 0 returned notify

Here's an nmap of the server (1.1.1.1 is not the real IP address):

$ nmap -P0 -sU -p 500 1.1.1.1
Starting Nmap 7.70 ( https://nmap.org ) at 2021-07-08 07:25 PDT
Nmap scan report for 1.1.1.1
Host is up.

PORT    STATE         SERVICE
500/udp open|filtered isakmp

Nmap done: 1 IP address (1 host up) scanned in 4.16 seconds

Here's ip route show output:

default via 192.168.1.254 dev eno1 proto dhcp metric 100 
169.254.0.0/16 dev eno1 scope link metric 1000 
192.168.1.0/24 dev eno1 proto kernel scope link src 192.168.1.101 metric 100 

I've googled for hours, but I'm still getting timeouts.

I have 3 related questions:

  1. How can I establish a working VPN from Debian 10.10 to Fortigate (unknown version, I have no control over the server) using LibreSwan 3.27-6+deb10u1?
  2. Why doesn't LibreSwan ask me for my password and 2fa data? When I was trying vpnc, it asked for these every time I tried to initiate a connection.
  3. Only if it sounds relevant: Why doesn't ike-scan like the Fortigate server?

Thanks!

9
  • Please provide a sanitize version of cat etc/ipsec.d/office.secrets you probably also need nat_traversal=yes given the subnet your connecting to; You really should find out what version of Fortigate that’s being used; it could very well be a server configuration issue (granted you can’t solve that problem)
    – Ramhound
    Jul 7, 2021 at 23:27
  • sent v2I1, expected v2R1 means your not even communicating with the server by the way. At that state you haven’t even attempted to authenticate with the sever. The client sent an initial handshake message and received nothing from the server. This matches the behavior of your other clients by the way
    – Ramhound
    Jul 7, 2021 at 23:35
  • I've added nat_traversal=yes, and am checking on the Fortigate version number.
    – dstromberg
    Jul 8, 2021 at 13:52
  • You might want to define the interfaces for the connection. /etc/config/network and /etc/config/firewall might also be helpful. You have actually verified from your IT department that you have the correct connection information? Because you are getting zero response from the host. An output of ip route show might be in order at this point. An intranet address do not have to be redacted since they only exist within your own network.
    – Ramhound
    Jul 8, 2021 at 13:58
  • I have no /etc/config/network. I do have a /etc/network/interfaces.d, but it has no files in it. I'll confirm that I have the correct hostname.
    – dstromberg
    Jul 8, 2021 at 14:02

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.