No-meraki vpn problems with Fortigate

[Nandoneves]

Hi guys.

Firewall MX MX67 - version 18.211.3

Firewall Fortigate

I'm having trouble solving a disconnection problem on a non-Meraki site-to-site VPN with a Fortigate. The Fortigate is located inside Azure.

The phase 1 and phase 2 configurations are correct on both sides. On the Meraki side, I see an event log showing only connections being reestablished.

On the Fortigate side, I can see errors in phase 1 "Payload malformed".
I'm using IKVE1, the subnets are being advertised on both sides of the peers.
The problem started occurring a few days ago.

Another observation, I see the tunnel down on the Meraki dash, but on the Fortigate the VPN shows UP.
Has anyone else experienced the same difficulty?

[BrentB · Accepted solution]

Try IKEv2? We were having similar issues with connection into AWS and came down to one side being route based and the other policy based. I think the Meraki is policy based when on IKEv1 but it will use router based with IKEv2. I would have to go back and find the doc. We switched to IKEv2 and link popped right up?

[Nandoneves]

Hi BrentB.

I removed the VPN and created it again, but it didn't work.
I changed the mode to IKEV2 and it was up and running.
We're still monitoring it and it's still stable.
Thank you.

[alemabrahao]

Have you had any changes to your network recently, such as a firmware update for example?

[PhilipDAth]

I agree with @alemabrahao , check for recent firmware updates on the Meraki.

[Nandoneves]

Hi Alemabrahao.

No updates or changes to the environment.

[Erminio]

Hi,

I encounter also some problems create an IPSec between a FG and an MX.

The solution for me was make the the remote ID on the MX side en de Local ID on the FG site the same.

After that everything worked fine since than.

Grtz. Erminio

[Nandoneves]

Hi Erminio.

I'm also having trouble configuring a No-Meraki VPN between MX_x_Fortigate.

The peer configuration is pointing to the Remote ID on the mx and the local ID on the fortigate. I noticed that in IKEV2 mode it remained stable.

In IKEV1 mode I could see many errors in phase 1.
Thank you for sharing your suggestion.

[Nandoneves]

Guys, Morning.

After change to IKEV2, i see in the event logs, many register VPN no-Meraki.

Verifed the uplinks in the firewall MX, no latency, drops in the links, no register.

Any recommended changes to the peer settings?
Thank you.