Hello,
i have a site to site between two sites.
The Policy are
10.0.89.64/26 → 10.1.89.64/26
10.0.89.64/26 → 10.1.90.64/26
The other side is a Fortigate firewall .
The LAN on my side is 192.168.1.64/26 , i have netmap srcnat/dstnat 192.168.1.64/26 ↔ 10.0.89.64/26 using connection_mark for connection to dst-address-list ip addresses.
Randomly the phase 2 goes down, if i check logs on my side there is “NO PROPOSAL CHOSEN” and i don’t know the reason.
I do not have access to the remote logs of the other side so i do not know how can i fix this.
Normally the VPN works well, this happens randomly so i don t know
In that case, it was your Mikrotik that did not like a request from the Fortigate, hence the previous lines in the log should show what the request contained and what RouterOS did not like about it.
It indeed writes “encrypted payload” into the log, however it also shows the decrypted contents in hexadecimal form (if you remove the !packet part from the topics list under /system logging, see here how to visualize it if really necessary), but even more important, it usually shows the contents in an even more readable form. At least you should see the required traffic selector and the proposed transform values in the request from the Fortigate. See an example below: