Skip to main content
MBruenisholz
New Member
August 29, 2012
Question

Android VPN with IPSec/XAuth

  • August 29, 2012
  • 4 replies
  • 7860 views
Hi everyone I' m trying to establish a VPN-Connection between an android-tablet (Android 4.0.3) with our Fortigate (MR3Patch8). I know the cookbook-article about how to establish a connection using L2TP over IPSec... but that' s not what i want. Since it is possible to use IPSec with Xauth since Android 4, i want to use this. We' re already using it with iPhones/iPads. And some blog-articles state that it' s also possible with android... but i cant get it to work. Actually i see just one single " negotiate progress IPsec phase 1" message with status success, that' s all. Not a proposal mismatch or error. And after a short time, i get a timeout on the tablet and see a delete_phase1_sa in the eventlog. My configuration looks like this atm Phase1
  config vpn ipsec phase1-interface      edit " v_test_android"           set type dynamic          set interface " cc_inet"           set dhgrp 2          set peertype one          set xauthtype auto          set mode aggressive          set mode-cfg enable          set proposal aes128-sha1          set peerid " androidvpn"           set authusrgrp " androidvpn"           set ipv4-start-ip 192.168.244.30          set ipv4-end-ip 192.168.244.40          set ipv4-netmask 255.255.255.0          set dns-mode auto          set psksecret ***      next  end  
Phase2
config vpn ipsec phase2-interface      edit " v_test_android_ph2"           set phase1name " v_test_android"           set proposal aes128-sha1      next  end
On the tablet i' ve configured a " IPSec Xauth PSK" connection, using the " androidvpn" as IPsec-ID. I' ve already tried many combinations with different proposals, with or without peertype, with PAP or CHAP instead of auto... nothing worked. I' m sure it' s no matter of user/password or PSK, because on an iPad i can connect with this proposals. Does anyone already made this to work or has some hints for me? Thx a lot Mike

    4 replies

    MBruenisholz
    New Member
    August 30, 2012
    Little update: Obviously i had an error with the psk (don' t know how this could happen...) But now i' m stuck at " XAUTH authentication failed"
    MBruenisholz
    New Member
    August 30, 2012
    OK, we can close this case... seems to be an android-bug. Here my observations, hope i can help someone else who' s stuck with something similar. I did some debugging, with diag debug app ike 255, and found this:
    2012-08-30 14:35:23 ike 0:v_test_android_0:232958: received XAUTH_USER_NAME ' andr2'  length 5  2012-08-30 14:35:23 ike 0:v_test_android_0:232958: received XAUTH_USER_PASSWORD length 9  2012-08-30 13:56:27 ike 0:v_test_android_0: XAUTH failed for user " andr2" , retry(2).
    I was confused about the XAUTH_USER_PASSWORD length 9... because the password of this user is only 8 characters long. Tried some other passwords with other lengts, and every try was one digit longer than it should be. I found the " VpnCilla" App in the Play store and gave it a try. It worked like a charm!
    2012-08-30 14:35:23 ike 0:v_test_android_0:232958: received XAUTH_USER_NAME ' andr2'  length 5  2012-08-30 14:35:23 ike 0:v_test_android_0:232958: received XAUTH_USER_PASSWORD length 8  2012-08-30 14:35:23 ike 0:v_test_android_0: XAUTH user " andr2"  in group ' androidvpn'  (9)  2012-08-30 14:35:23 ike 0:v_test_android_0: XAUTH succeeded for user " andr2
    You can see, the length is now 8, exactly as it should be. Seems like the built-in vpn client does not submit the password the right way. I' m happy to see it was no problem on the fortigate Will now see if this is a known bug in android, otherwise i' ll try to submit it.
    IT_Operations
    New Member
    September 10, 2012
    I had this same problem on ICS, both tablet and phone. Must be some sort of android bug in their client, because i also ended up going the VpnCilla route, which i' m very happy with. -Tony
    MBruenisholz
    New Member
    September 10, 2012
    Thanks for your reply, good to know that i' m not the only one with this problem. I' ve created a bugreport ( [link]https://code.google.com/p/android/issues/detail?id=36879&thanks=36879&ts=1346334949[/link] ), but no reaction untill yet. Mike
    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT