Create Site To Site IPSEC vpn between local fortigate and Azure

Ala Abukhazneh 0

Hello Dears,

I need your help in creating site to site vpn connection with Azure , from our local fortigate device, i followed the steps in FortiOS 7.0.10 Administration Guide pages 1369 - 1380 , and with no success , any previous experince would be so great .

Thanks in advance

Tushar Kumar 3,226 Reputation points MVP

2023-05-21T08:24:14.73+00:00

Hi Ala,

Can you share more details on what is the error that you are facing, Is the connection getting stuck in phase 1 or 2 ?

https://docs.fortinet.com/document/fortigate-public-cloud/7.2.0/azure-administration-guide/989216/connecting-a-local-fortigate-to-an-azure-vnet-vpn

Try to follow the above link it has all the required debugging steps as well!
JimmySalian-2011 41,921 Reputation points

2023-05-21T10:18:04.1866667+00:00

Hi,

Worth checking this article here as this might assist in creating and step by step guide will be easy - https://newhelptech.wordpress.com/2022/01/01/step-by-step-how-to-configure-site-to-site-vpn-microsoft-azure-to-fortigate/

==

Please don't forget to upvote and Accept as answer if the reply is helpful
KapilAnanth-MSFT 35,336 Reputation points Microsoft Employee

2023-05-22T05:14:54.5133333+00:00
@Ala Abukhazneh

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are facing issues with creating a S2S Connection between Azure VPN Gateway and your local Fortigate device.

From here, FortiOS 5.6 is supported. I believe higher versions should also be supported in this case.

Can you please elaborate what exactly is the issue here?

Is Azure S2S Connection showing as "Connected" but traffic is not flowing?

Or it is not connected at all?

Cheers,

Kapil
Ala Abukhazneh 0 Reputation points

2023-05-22T05:15:25.6666667+00:00

Tnaks a lot dears for your prompt respomse , i wil check the suggested articles and try to resolve the issue , as for the error the connection stucks at phase1>
Ala Abukhazneh 0 Reputation points

2023-05-22T05:18:05.42+00:00

@KapilAnanth-MSFT thanks alot for your kindness , actually the tunnel is not connected at all stucks at phase1
KapilAnanth-MSFT 35,336 Reputation points Microsoft Employee

2023-05-22T06:20:25.02+00:00
@Ala Abukhazneh

Thanks for the info.

Then I would recommend you to check Gateway using diagnostic logs

Especially,

TunnelDiagnosticLog

IKEDiagnosticLog

To enable Diagnostic logs

In your Azure portal, search for Monitor.

Go to Diagnostics settings blade within Monitor and search for your VPN gateway in which you would like to enable diagnostics.

To turn on diagnostics, double-click the gateway and then select Turn on diagnostics.

Fill in the details, and ensure that Send to Log Analytics and TunnelDiagnosticLog are selected.

Choose the Log Analytics Workspace where you want to send the logs to. It may take a few hours for the data to show up initially.

Run the queries for past 1 hour and share the results please.

Cheers,

Kapil.
KapilAnanth-MSFT 35,336 Reputation points Microsoft Employee

2023-05-23T06:21:06.5866667+00:00

@Ala Abukhazneh

May I know if you got a chance to review my previous comment?

Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.

Thanks,

Kapil
Ala Abukhazneh 0 Reputation points

2023-05-23T13:01:40.04+00:00

thanks alot KapilAnanth-MSFT I implemented the diagonistics configuration as described but still waitting the logs to show up, i will share the results
Ala Abukhazneh 0 Reputation points

2023-05-23T14:13:25.5666667+00:00

actually this is the logs i got
Ala Abukhazneh 0 Reputation points

2023-05-23T14:14:05.25+00:00

PT1H (1).xml

actually this is the logs i got
KapilAnanth-MSFT 35,336 Reputation points Microsoft Employee

2023-05-23T17:07:29.34+00:00
@Ala Abukhazneh

Looking at the logs, Azure VPN Gateway is not receiving any packets from OnPrem VPN Device.

Consider any random Session ID (40224d48-5709-447b-a985-77f7a14d9cd6),

Azure is sending a SA_INIT

And then we send the IKE Payload for Phase1

And then Azure tries to retransmit the packet twice, but unable to get a response

Hence Azure VPN gateway calls error "13805" - which is "Negotiation timed out." Refer : System Error Codes

We can also see a verbose of the same.

Next steps,

Please check the logs from your VPN device and make sure if packets from Azure are properly reduced.

Verify if the IP mentioned in the LNG correctly represents the Fortigate's IP.

In the Fortigate VPN device, please validate if Azure VPN Gateway's IP is properly configured or not.

Cheers,

Kapil
Ala Abukhazneh 0 Reputation points

2023-05-24T07:49:08+00:00

i changed the local gateway to another interface the error message changed to

IkeCleanupMMNegotiation called with error 13004 and flags 2","instance":"GatewayTenantWorker_IN_0"}, "ClientOperationId": "00000000-0000-0000-0000-000000000000", "CorrelationRequestId": "00000000-0000-0000-0000-000000000000", "GatewayManagerVersion": "23.2.100.14"}

any clues ?
KapilAnanth-MSFT 35,336 Reputation points Microsoft Employee

2023-05-24T09:24:22.21+00:00

@Ala Abukhazneh

Again, 13004 seems to be Policy Mismatch.

This indicates that the remote interface is not configured properly.

Request you to check the logs from the remote site and see if Azure packets are received or not and if they are received, what's the error message thrown at the VPN device side

Cheers,

Kapil
KapilAnanth-MSFT 35,336 Reputation points Microsoft Employee

2023-05-25T09:01:37.48+00:00

@Ala Abukhazneh

Can you please update us if the action plan provided was helpful?

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

Thanks,

Kapil
Taha Yaseen 1 Reputation point

2023-08-07T08:26:05.5833333+00:00

For me it says this

1 answer

msrini-MSFT 9,261 Reputation points Microsoft Employee

2023-05-22T07:37:08.86+00:00

Hi,

Can you make sure that the Phase 1 parameters matches with what is mentioned in this doc : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices#ike-phase-1-main-mode-parameters ?

Can you double check if the pre-share keys are identical on Azure and FortiGate ?

Regards,

Karthik Srinivas
Please sign in to rate this answer.
Ala Abukhazneh 0 Reputation points

2023-05-23T13:02:55.63+00:00

thanks alot msrini-MSFT , i did as per the recomendation but despite i selected policy based IKE is IKE2 not IKE 1 , is this configurable? how ?
Sign in to comment