Technical Tip: Remote IPsec VPN with FortiClient VPN in IOS devices

This article provides guidance for configuring FortiClient on iOS with a FortiGate IPsec remote-access VPN using IKEv2, which is the supported approach for current FortiClient releases.

Proceed to download the FortiClient app from this link: Product Downloads.

Note: After downloading the FortiClient installer and opening the application for the first time, it is necessary to accept several pop-up notifications before proceeding with the VPN configuration.

• Open the FortiClient VPN application:

• Select 'Connection' and 'Add Configuration':

• Select 'Secure Protocol' as 'IKEV2 VPN' and provide 'Name' as the IPsec Remote VPN name configured on FortiGate. Add the 'Server Address' as the interface IP of the IPsec VPN and set the same 'pre-shared key'.

• Enable the EAP-Auth (Mandatory) and set Local and Remote Identifier (Optional):

• Select the phase1 and phase2 ciphers and Lifetime matching with FortiGate settings:

• Add the username at the bottom and save the settings.

• Return to the VPN first page and select 'Connect'. That will prompt for username and password for the 'Mac-user'. 
  

Notes:

• If issues connecting are encountered, ensure that the server address and credentials are correct.
• Check the network connection to ensure there is internet access.
• If using a corporate network, it is necessary to verify VPN permissions.
• If FortiToken is used, it will not work for Non-SAML authentications with IPsec. 
• If the VPN connection issue persists, collect IKE debug logs for further troubleshooting: Troubleshooting Tip: IPsec VPN tunnels.

• FortiClient for iOS does not support separate FortiToken authentication when connecting to a dial-up VPN gateway. As a workaround, enter the FortiToken code together with the password in the password field when signing in:

Password: iOSrul3s.

FortiToken Code: 123456.
The user will enter iOSrul3s123456 when prompted for the password.

Related documents:

• Technical Tip: Apple IOS native VPN using IKEv2 connection for IPsec VPN to FortiGate
• Technical Tip: iPhone and iPad Dialup User IPsec VPN sample configuration 
• iOS device as dial-up client
• IPsec VPN
• Running FortiClient iOS
• Technical Tip: IPsec dial-up tunnel using IKEv2 with FortiToken 2FA for local users 
• Technical Tip: Getting FortiClient from the Apple Store on Mac or Mobile vs Fortinet download page