Troubleshooting Tip: Users cannot connect to a Dial-up IPsec VPN with 'IPv4 pool is not configured' message in IKE debug

IKE debugs on FortiGate show the following messages (outputs truncated): 

diagnose debug reset
diagnose debug application ike -1
diagnose debug enable

ike V=root:0:Dialup:0: responder: aggressive mode get 2nd response...
ike V=root:0:Dialup:0: PSK authentication succeeded           <----- Pre-shared key is correct. 
ike V=root:0:Dialup:0: authentication OK
ike V=root:0:Dialup: IPv4 pool is not configured              <----- No 'Client Address Range' configured. 
ike V=root:0:Dialup: IPv6 pool is not configured

ike V=root:0:Dialup_0:0: received XAUTH_USER_NAME 'guest' length 5
ike V=root:0:Dialup_0:0: received XAUTH_USER_PASSWORD length 6
ike V=root:0:Dialup_0: XAUTH user "guest"
ike V=root:0:Dialup: auth group Guest-group
ike V=root:0:Dialup_0: XAUTH 8882150748161 pending
ike V=root:0:Dialup_0:0: XAUTH 8882150748161 result FNBAM_SUCCESS
ike V=root:0:Dialup_0: XAUTH succeeded for user "guest" group "Guest-group" 2FA=no

ike V=root:0: comes 192.168.x.x:500->192.168.x.x:500,ifindex=5,vrf=0,len=156....

ike V=root:0:Dialup_0:0: mode-cfg type 1 request 0:''
ike V=root:0:Dialup_0:0: mode-cfg not enabled, ignoring Configuration Method Request 

Once the debug is complete, use the following command to stop the debug:

diagnose debug disable

diagnose debug reset

The IKE debug outputs indicate that 'Mode Config' is not enabled and 'Client Address Range' is not configured on the FortiGate IPsec Phase 1 configuration. As a result, the configuration method request sent by the FortiClient was ignored. 

To resolve the issue, enable 'Mode Config' and configure 'Client Address Range' under VPN -> IPsec Tunnel -> Edit the IPsec tunnel. 

To do it in the CLI: 

config vpn ipsec phase1-interface
    edit "Dialup"
        set mode-cfg enable
        set ipv4-start-ip 192.168.13.1
        set ipv4-end-ip 192.168.13.10
    next
end

Note: When running the debug commands, the output can be filtered with the client public IP:

diagnose debug reset

diagnose vpn ike log-filter dst-addr4 <CLIENT_PUBLIC_IP>

diagnose debug application ike -1

diagnose debug enable

Once debugging is complete, use the following command to stop the processes:

diagnose debug disable

diagnose debug reset

To check the IKE statistics:

get vpn ike stats

Sniffer the traffic:

diagnose sniffer packet any "udp port 500 or udp port 4500" 4

Related articles: 

Technical Tip: How to enable IKE debugging with various debug levels using a bitmask to isolate specific types of information for troubleshooting IKE negotiation failures