Site to Site VPN

[Sharath Rajan]

Dears 

Please help me to get it fix site to site vpn with FCM7.0.1 added FTD6.4 to SonicWALL

IKEV2 SHA256/AES-256/DH-2 Lifetime 28800 already tried tunnel is not up still  

[MHM Cisco World]

do you config 
PFS and DH group ? if not please config it.

[Sharath Rajan]

Yes its configured no luck to handshake the policy


Sha256/Aes256/dh (2,5,14) ikev2 tried

[MHM Cisco World]

Pfs and dh group is config in phase II.

[Sharath Rajan]

Its done in phase2 .
Both firewall pfs enabled and dh (2/4/5/14)all tried one by one its not
working

[MHM Cisco World]

sorry this for IKEv1 below the link for IKEv2.
https://bluenetsec.com/cisco-fmc-site-to-site-vpn/

check this link are you do same steps?

[Sharath Rajan]

Hi 

Thank you 

these steps already tried IKEv1 with Mainmode of saonicwall result was failed 

[Sharath Rajan]

Please help me experts these all my configuration 

[SinghRaminder]

provide the output from FTD cli:

show crypto isa sa

[Sharath Rajan]

Thank you done the command 

reply is 

[MHM Cisco World]

Hi friend this for IKEv2 
check the step
https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/215470-site-to-site-vpn-configuration-on-ftd-ma.html

[Sharath Rajan]

Hi Thank you 

this link FDT with ASA 

but mine FDT with SonicWALL I tried these all proposals and PRF is not showing   in Sonicwall 

[SinghRaminder]

Hello Sharath

AFAIK Sonic Wall does not have the option to specify PRF. it will use the same algorithm you used for Integrity in phase 1 for PRF as well

Since your phase 1 is not coming up, it means they are not agreeing on parameters. 

Can you provide the output here : show run crypto ikev2 

and check the parameters you using for Sonicwall connection and make sure to make the prf value on the FTD the same as integity value used on both sides.

For example :

crypto ikev2 policy 10
encryption aes256
integrity sha256
group14
prf sha256
lifetime seconds 86400

Make sure Integrity on Sonicwall is set to SHA256 as well

[Sharath Rajan]

Dear Singh 

Thank you ,Please look on the share post here FMC-FDT and SonicWALL Proposals 

still not responding the tunnel for up .