Explorer

Question

FortiGate - Dial-UP-IPSEC Tunnel - Problem with TCP as transport mode

Forum|Forum|1 year ago
February 19, 2025
8 replies
2768 views

Hello. I want to setup a dial up ipsec vpn tunnel from FortiClient to FortiGate. The tunnel is working with transport mode "udp" and port "500".

When I change the transport mode in phase1-settings to "tcp" or "auto" and than use "tcp" in FortiClient, the FortiClient is running in an timeout. I have tested with local and sso users. Both same beahviour. I also tested different tcp ike-ports in "conf system settings".

Any ideas?

FortiGate: 7.4.7

FortiClient: 7.4.2

Toshi_Esumi

SuperUser

When I tried the same in similar environment, I encountered the same/similar issue. I opened a ticket to ask TAC. Then got this instruction to enable EAP.
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Using-IKEv2-for-a-dial-up-IPsec-tunnel-with/ta-p/229663
I indeed saw "gw validation failed" error in IKE debugging.

After that, it started working.

Toshi

michael2406Author

Explorer

EAP is already enabled.

MZBZ

Staff

Open a TAC ticket with logs according to: https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-Collecting-logs-for-addressing-VPN/ta-p/362101

Also include packet captures from client and FortiGate side.

michael2406Author

Explorer

Thank you. FortiGate see FSSO Login than no answer.

FortiClient Log says: "No response from the peer, phase1 retransmit reaches maximum count"

michael2406Author

Explorer

Here is the log from FortiClient. Interesting thing: Why is it using port 500 even if I change it to tcp and 443?

Bug in FortiClient?

msg="No response from the peer, phase1 retransmit reaches maximum count" vpntunnel=test2 locip=192.XXX.XXX.XXX locport=500 remip=XX.XXX.XXX.XXX remport=500

MZBZ

Staff

Export FortiClient config and confirm the port+proto and check the values under Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FortiClient\IPSec\Tunnels

michael2406Author

Explorer

For me both is looking good.

MZBZ

Staff

To address this issue, it's necessary to review the FortiGate and FortiClient configurations as well as the IKE debug logs. Because these contain confidential personal information, I strongly recommend opening a TAC ticket. Alternatively, you could share them here publicly, although this is not advisable.

Sign up

Login with SSO

Login to the community

Login with SSO