IPSEC VPN - Invalid ESP packet detected (HMAC validation failed)




https://kb.fortinet.com/kb/documentLink.do?externalID=FD33101

The ESP packet invalid error is due to an encryption key mismatch after a VPN tunnel has been established. When an IPSec VPN tunnel is up, but traffic is not able to pass through the tunnel, Wireshark (or an equivalent program) can be used to determine whether there is an encryption mismatch. A mismatch could occur for many reasons, one of the most common is the instability of an ISP link (ADSL, Cable), or it could effectively be any device in the physical connection.

The following information is required to troubleshoot the problem.

1) Take a packet sniffer trace on both FortiGates.
2) Run the "diag vpn tunnel list” command a few times on both FortiGates when generating traffic that will pass through the tunnel.

In the following example, the error message was seen on the recipient FortiGate:
date=2010-12-28 time=18:19:35 devname=Kosad_VPN device_id=FG300B3910600118 log_id=0101037132 type=event subtype=ipsec pri=critical vd="root" msg="IPsec ESP" action="error" rem_ip=180.87.33.2 loc_ip=121.133.8.18 rem_port=32528 loc_port=4500 out_intf="port2" cookies="88d40f65d555ccaf/05464e20e4afc835" user="N/A" group="N/A" xauth_user="N/A" xauth_group="N/A" vpn_tunnel="fortinet_0" status=esp_error error_num=Invalid ESP packet detected (HMAC validation failed). spi=c32b09f7 seq=00000012
This is the output of the command “diag vpn tunnel list” on the FortiGate.
inet ver=1 serial=2 192.168.1.205:4500->121.133.8.18:4500 lgwy=dyn tun=intf mode=auto bound_if=4
proxyid_num=1 child_num=0 refcnt=7 ilast=0 olast=0
stat: rxp=41 txp=56 rxb=4920 txb=3360
dpd: mode=active on=1 idle=5000ms retry=3 count=0 seqno=696
natt: mode=keepalive draft=32 interval=10 remote_port=4500
proxyid=P2_60C_Fortinet proto=0 sa=1 ref=2 auto_negotiate=0 serial=1 src: 0:182.40.101.0/255.255.255.0:0
dst: 0:100.100.100.0/255.255.255.0:0
SA: ref=3 options=0000000d type=00 soft=0 mtu=1428 expire=1106 replaywin=0 seqno=15
life: type=01 bytes=0/0 timeout=1777/1800
dec: spi=29a26eb6 esp=3des key=24 bf25e69df90257f64c55dda4069f01834cd0382fe4866ff2
ah=sha1 key=20 38b2600170585d2dfa646caed5bc86d920aed7ff
enc: spi=c32b09f7 esp=3des key=24 0abd3c70032123c3369a6f225a385d30f0b2fb1cd9687ec8
ah=sha1 key=20 214d8e717306dffceec3760464b6e8edb436c6


Disable Replay Detection in Phase 2 settings of IPsec VPN.



Picture from Logo

Popular posts from this blog

Mikrotik v.7 Using cell lock on LHG LTE18

Image
  There  is  a way to do a cell lock on EG18-EA modem, it worked for me on LHG LTE18 kit. All information below is taken from  this thread on the Quectel forum . You will need to figure out PHY-CELLID (ID of the cell itself) and EARFCN (frequency that will be locked as primary band). You can get a list of cells around you and corresponding frequencies using cell monitor via web UI or console with: Code:  Select all interface / lte / cell - monitor lte1 You will get something like this: Code:  Select all PHY - CELLID BAND EARFCN RSRP RSRQ RSSI AGE 247 B7 2850 - 99dBm - 9dB - 68dBm 1s 99 B7 2850 - 104dBm - 15dB - 79dBm 1s 258 B7 2850 - 107dBm - 16dB - 83dBm 1s 69 B7 2850 - 111dBm - 20dB - 79dBm 1s 362 B7 2850 - 115dBm - 20dB - 85dBm 1s Next, use the following command to  set a cell lock : Code:  Select all interface /...
Read more

Zabbix Proxy RAM config

Image
Zabbix Proxy RAM config Content is copyed from  ZNIL.NET 2.1  Install Raspbian You download NOOBS: 5  Configure the Zabbix proxy We open the configuration file nano /etc/zabbix/zabbix_proxy.conf and adjust at least the following lines: Server = IP or DNS name of the Zabbix server to be reported to # Hostname -> under this name we also have to create the proxy on the main server! Hostname = zabbixproxy # Increase command timeout. This is how long the proxy waits for replies from scripts, checks and agents Timeout = 30 # New 3.4 feature - RemoteCommands now also work behind proxies EnableRemoteCommands = 1 LogRemoteCommands = 1 # Database and log in the RAM disk (do not change the lines if not desired) LogFile = / var / ramdisk / zabbix_proxy.log LogFileSize = 4 DBName = / var / ramdisk / zabbixproxy.db https://www.raspberrypi.org/downloads/noobs/ I recommend the normal variant, not the Lite - especially if you are on the go in company networks.  Noobs ...
Read more