IKE_SA_INIT Exchange:

The IKE_SA_INIT exchange is the first step in the IKEv2 negotiation process. It is responsible for

setting up the initial security association (SA) and performing Diffie-Hellman key exchange.

During this exchange, the responder may employ various measures to protect against Denial of

Service (DoS) attacks, such as rate limiting and the use of puzzles to increase the computational cost

for an attacker.

DoS Protection Mechanisms:

One key method involves limiting the number of half-open SAs from any single IP address or subnet.

The IKE_SA_INIT exchange can also incorporate the use of stateless cookies, which help to verify the

initiator's legitimacy without requiring extensive resource allocation by the responder until the

initiator is verified.

Reference:

RFC 5996: Internet Key Exchange Protocol Version 2 (IKEv2)​(RFC Editor)​.

RFC 8019: Protecting Internet Key Exchange Protocol Version 2 (IKEv2) Implementations from

Distributed Denial-of-Service Attacks​(IETF Datatracker)​.

Session Synchronization:

FortiGate HA (High Availability) ensures that active sessions are synchronized between the primary

and secondary devices. This synchronization allows for seamless failover and continuity of sessions.

Handling NAT Sessions:

The session in the exhibit has NAT applied, as indicated by the hook=post dir=org act=snat entry.

FortiGate's HA setup is designed to handle such sessions, ensuring that traffic continues without

interruption during failover.

Session Preservation:

Even with the presence of NAT, the session state is preserved across the HA devices. This means that

ongoing sessions do not require re-establishment by the client, thus providing a seamless

experience.

Reference:

Fortinet Documentation: HA session synchronization and failover

Fortinet Community: Understanding session synchronization in FortiGate HA

The exhibit displays the output of a real-time debug of the URL filtering process on a FortiGate

device. The debug output includes various details about a web request being processed.

SNI (Server Name Indication): This is part of the SSL/TLS handshake where the client specifies the

hostname it is trying to connect to. FortiGate can use this information to apply appropriate web

filtering rules based on the server name.

CN (Common Name): This is a field in the server's SSL certificate that typically contains the server's

hostname. FortiGate can extract this information to verify the identity of the server and apply

security policies accordingly.

Given that the debug output includes the hostname "training.fortinet.com," it is likely derived from

the SNI in the client's request or the CN in the server's certificate, indicating that FortiGate is using

this information to process the web request.

Reference:

Fortinet Community Documentation on Real-time Debugging

The BGP summary output shows the state of the 10.200.3.1 peer as "Connect." This state indicates

that the local router has attempted to initiate a BGP session with the peer, but the peer has not yet

responded to the initial connection request.

State Explanation: The "Connect" state in BGP indicates that the TCP connection has been initiated

but is waiting for a response. If the peer does not respond within the configured timers, the session

will transition to the "Active" state and retry the connection.

Possible Causes: This can occur due to network issues preventing the peer from responding, a

misconfiguration on the peer device, or issues like access control lists (ACLs) blocking the BGP traffic.

To troubleshoot, check the connectivity between the routers, ensure that the BGP configurations on

both sides match, and verify that there are no firewalls or ACLs blocking the BGP packets.

Reference:

Fortinet Documentation on BGP Troubleshooting

Fortinet Community Discussion on BGP State Issues

Remote Gateway IP:

The output shows 10.200.5.1 as the remote gateway IP, confirming that this is the IP address of the

remote gateway involved in the IPsec VPN tunnel.

Quick Mode Selectors:

The quick mode selectors specify the subnets involved in the VPN. The output shows src:

0:10.1.2.0/255.255.255.0:0 and dst: 0:10.1.1.0/255.255.255.0:0, indicating the subnets being

tunneled.

DPD (Dead Peer Detection):

DPD is shown as mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0, indicating that

DPD is enabled in on-demand mode.

Anti-replay:

The output includes replaywin=2048 and replaywin_lastseq=00000000, which are indicators that

anti-replay protection is enabled for the IPsec tunnel.

Reference:

Fortinet Network Security 7.2 Support Engineer Documentation

VPN Configuration and Diagnostic Guides

Capturing ESP Traffic:

ESP (Encapsulating Security Payload) traffic is associated with IPsec and is identified by the protocol

number 50. To capture ESP traffic, you need to filter packets based on this protocol.

In this specific case, you also need to filter for the host associated with the VPN tunnel, which is

10.200.3.2 as indicated in the exhibit.

Sniffer Command:

The correct command to capture ESP traffic for the VPN named DialUp_0 is:

diagnose sniffer packet any ‘esp and host 10.200.3.2’

This command ensures that only ESP packets to and from the specified host are captured, providing a

focused and relevant data set for troubleshooting.

Reference:

Fortinet Documentation: Verifying IPsec VPN Tunnels​(Fortinet Docs)​​(Welcome to the Fortinet

Community!)​.

Fortinet Community: Troubleshooting IPsec VPN Tunnels​(Welcome to the Fortinet Community!)​​

(Fortinet Docs)​.

IKE_SA_INIT:

This is the first exchange in IKEv2. It establishes a secure, authenticated channel between peers and

negotiates cryptographic algorithms and keys.

IKE_Auth:

The second exchange authenticates the IKE SA (Security Association) using the previously negotiated

keys and algorithms. This exchange also establishes the first IPsec SA.

Create_CHILD_SA:

This exchange creates additional IPsec SAs after the initial authentication. It can also be used to rekey

existing IPsec SAs to maintain security.

Informational:

This is a generic exchange used for various purposes such as error notification, deletion of SAs, and

other control messages.

Reference:

Fortinet Community: IKEv2 packet exchanges and troubleshooting

Fortinet Documentation: IPsec VPN Concepts

Next-hop IP address:

For a static route to be added to the routing table, the next-hop IP address must be reachable. If it is

not reachable, the route cannot be considered valid and will not be added.

Interface status:

If the interface specified in the static route configuration is down, the route will not be added to the

routing table. The interface must be up and operational for the route to be valid.

Priority and Distance:

While priority and administrative distance affect route selection, they do not prevent a route from

being added to the routing table. Instead, they influence which route is preferred when multiple

routes to the same destination exist.

Reference:

Fortinet Network Security 7.2 Support Engineer Documentation

Routing Configuration and Troubleshooting Guides

Analyzing Debug Output:

The debug output shows multiple proposals with encryption algorithms like AES CBC and hashing

algorithms like SHA256.

The negotiation failure (no SA proposal chosen) suggests that there is a mismatch in the encryption

or hashing algorithms between the local and remote gateways.

Configuration Change:

To resolve the phase 1 negotiation error, the local gateway needs to include a compatible proposal.

Adding AES256-SHA256 to the phase 1 proposal configuration ensures that both gateways have a

matching set of encryption and hashing algorithms.

Reference:

Fortinet Documentation: Configuring IPsec Tunnels​(Fortinet Docs)​​(Welcome to the Fortinet

Community!)​.

Fortinet Community: Troubleshooting IKE Negotiation Failures​(Welcome to the Fortinet

Community!)​​(Welcome to the Fortinet Community!)​.

Refused Connection: A refused connection typically indicates a mismatch in the TCP port

configuration between the FortiGate and the collector agent. Ensuring both are configured to use the

same TCP port is crucial for proper connectivity.

Mismatched Pre-Shared Password: If the pre-shared password configured on the FortiGate does not

match the one set on the collector agent, authentication will fail, leading to connectivity issues.

Inability to Reach IP Address: This can occur due to network issues such as incorrect routing, firewall

rules blocking traffic, or the collector agent being down. Verifying network connectivity and the

status of the collector agent is necessary to resolve this issue.

Reference:

Fortinet Community: Troubleshooting FSSO Connectivity Issues​(Welcome to the Fortinet

Community!)​​(Welcome to the Fortinet Community!)​​(Welcome to the Fortinet Community!)​.