"ignoring IKE request, no policy configured": Site-to-Site VPN Between Fortinet and Sangfor Firewalls
The Site-to-Site VPN between Fortinet and Sangfor firewalls was initially set up but encountered a disconnection issue.
Troubleshooting it required.
Diagnosing it on the Forinet Firewall:
diagnose debug reset
diagnose debug application ike -1
diagnose debug enable
diagnose vpn ike log-filter dst-addr4 {remote_peer_ip}
Output:
ike 0: comes 10.0.0.1:500-> 10.1.0.1:500
ike 0:SiteA_TO_SiteB: ignoring IKE request, no policy configured
ike 0:54b7251898a6fe59/0000000000000000:28926: VID unknown (16): 1422D71368A1F1C96B4496FC77570100
ike 0:54b7251898a6fe59/0000000000000000:28926: negotiation failure
ike Negotiate ISAKMP SA Error: ike 0:54b7251898a6fe59/0000000000000000:28926: no SA proposal chosen
ike 0:SiteA_TO_SiteB: gw negotiation timeout
ike 0:SiteA_TO_SiteB: ignoring request to establish IPsec SA, no policy configured
Log messages showing the need on Firewall Policy.
The Site-to-Site VPN connection was to normal after updating the policies.
Disabling & resetting diagnose, then.
diagnose debug disable
diagnose debug reset
References
Technical Tip: Understanding the ikev2 debugs SA_INIT and IKE_AUTH
Update