Technical Tip: No bytes are received when connected to IPsec dial-up VPN using FortiClient

Description

This article describes a possible cause when there is no traffic is seen on the FortiGate even after the proper route is pushed on the client when connected to dial-up VPN.

Scope

FortiGate, FortiClient.

Solution

When connecting to an IPsec dial-up VPN through FortiClient there are situations where there is no communication through the tunnel even after a successful connection and having a proper route seen on the endpoint.

• 10.40.50.1 = Client IP when connected to VPN.

• 10.30.30.1 = Destination IP which reside behind FortiGate.

• 10.200.200.2 = IP of the client behind ISP.

• 10.9.11.207 = Remote Gateway IP where the dial-up server is configured.

During the troubleshooting process, this traffic is not even seen on the FortiGate. 

The reason for this is that NAT cannot be performed on IPsec packets in ESP tunnel mode because the packets do not contain a port number. As a result, the packets cannot be de-multiplexed; the following is the capture taken on the ISP level showing the cause of the issue.

To resolve this issue, make sure that NAT-T is enabled on the VPN configuration on the FortiClient, as endpoints are mostly behind a NAT device.

Note:

IF IKE Version 2 is configured on the VPN settings, NAT Traversal will not be visible under settings.

To manually enable it from the FortiClient EMS or FortiClient VPN-(Free License) settings, see Troubleshooting Tip: IKEv2 IPSec VPN on FortiClient v7.4.1 and v7.4.2 has NAT-T disabled with default settings.

Results after NAT-T is enabled on the Client:

Traffic is also then observed on the FortiGate:

Note:

If the request is seen on the FortiGate, this should not be an issue with NAT-T.

First, verify that the authentication group is included in only one of the firewall policies or the IPsec phase1 configuration - not both. Either of the configurations below is valid:

1. Configure the group in the IPSec Phase 1 settings and leave the group field unset in the related firewall policies.

2. Specify the appropriate groups in the related firewall policies instead and do not configure a group in the IPSec Phase 1 setting.

Make sure no APIPA (169.254.x.x) IP is assigned to the tunnel interface and its gateway. See the related article section.

If none of the above apply, perform troubleshooting on the firewall end to find any possible issues related to policy, routing, etc. If any are encountered, open a ticket with the TAC team. Provide the IKE debug and the debug flow of the intended traffic to Support.

Related article:

Technical Tip: IPsec VPN NAT-traversal