Troubleshooting Tip: IKEv2 certificate authentication fails after upgrading to FortiOS v7.6.7

Description

This article describes an issue where an IKEv2 IPsec VPN using certificate-based authentication fails after upgrading the FortiGate to FortiOS v7.6.7.

Scope

FortiGate, FortiOS v7.6.7, certificate-based authentication.

Solution

This behavior is associated with Bug ID 1304588. FortiOS v7.6.7 may fail to send the intermediate CA certificate in the IKEv2 certificate payload, even when send-cert-chain is enabled (as it is by default for certificate-based IPsec).

config vpn ipsec phase1-interface
    edit "<tunnel_name>"
        set send-cert-chain enable
    next
end

Endpoints that do not already have the intermediate CA certificate installed may fail to validate the FortiGate certificate and terminate IKEv2 authentication.

Typical symptoms:

• The VPN worked before upgrading to FortiOS v7.6.7.

• The tunnel fails during IKE authentication.

• Rolling back to FortiOS v7.6.6 restores connectivity.

• Installing the intermediate CA certificate on the endpoint allows the connection to succeed.

Verification:

show full-configuration vpn ipsec phase1-interface <tunnel_name> | grep send-cert-chain

Workaround:

Install the required intermediate CA certificate in the trusted intermediate certificate store on the affected endpoint.

Note: This issue will be resolved in the upcoming FortiOS v7.6.8 and v8.0.1 releases.