New Member

Solved

Fortinet tunnel is showing inactive state

Forum|Forum|1 year ago
January 9, 2025
8 replies
5922 views

Hello All,

I have this issue. FortiGate 40F (v6.4.15 build2095)

Reproduction : I use the GUI not the CLI.

1. I created a vpn user

2. I assigned this user to a vpn group

3. I used th VPN wizard to create an Dialup FortiClient (Windows, Mac OS, Android) :
-> https://docs.fortinet.com/document/fortigate/6.4.15/administration-guide/785501/forticlient-as-dialup-client

4. In Firewall & Objects
-> Addresses :
-> Created automatically -> vpn1_range = 192.168.1.1-192.168.1.254
-> Created automatically -> vpn1_split = members = lan
-> Firewall Policy :
-> Created automatically -> vpn_vpn1_remote_0

-> The VPN was created, but shows INACTIVE.

I really don't understand. Can some help, please ?

Kind Regards,
Jo

FortiGate

Best answer by dingjerry_FTNT

And if possible, on your client, run WireShark to capture traffic on ports 500 or 4500.

dingjerry_FTNT

Staff

Hi @JoaquimdeSousa ,

Please get at least one client connected to the VPN, then check the status.

JoaquimdeSousaAuthor

New Member

Hi @dingjerry_FTNT,

Thanks for the quick reply.

On the client side : I tested using https://www.fortinet.com/support/product-downloads
-> FortiClient VPN for Windows

On the client side, the connection keeps timing out after some seconds.

On the Fortigate 40F, there is no change, it still displays "inactive".

I send you down below a screenshot of the events.

Kind Regards,
Jo

dingjerry_FTNT

Staff

Hi @JoaquimdeSousa ,

I hope that you have only one IPSec VPN tunnel there. If so, please run the following CLI commands:

diag debug reset

diag debug application ike -1

diag debug enable

Then try to connect again and collect the outputs.

To disable the debug:

diag debug reset

diag debug disable

diag debug application ike 0

JoaquimdeSousaAuthor

New Member

Hi @dingjerry_FTNT,

Thank you again for the quick reply.

But I Still get the same issue.

Log:
date=2025-01-09 time=20:39:57 eventtime=1736451597809526604 tz="+0100" logid="0101037134" type="event" subtype="vpn" level="notice" vd="root" logdesc="IPsec phase 1 SA deleted" msg="delete IPsec phase 1 SA" action="delete_phase1_sa" remip=XXX.XXX.XXX.XXX locip=192.168.68.99 remport=500 locport=500 outintf="wan" cookies="1678d6acabd314f9/b7e46b8981618a7d" user="N/A" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="vpn1"

I see that port 500 is trying to connect. But I did not create any VirtualIP with port 500.

Could it be that ?

If yes, how should I do it ?

Regards,
Jo

dingjerry_FTNT

Staff

Hi there,

For dialup VPN, it will connect via port 500, then switch to port 4500.

So please run the debug commands and collect the IKE outputs.

I suspect that your client's phase1 settings do not match the ones on FGT.

dingjerry_FTNT

Staff

Hi @JoaquimdeSousa ,

You may also:

1) Capture a screenshot of phase1 settings in your FortiClient;

2) Capture a screenshot of phase1 settings on your FortiGate;

JoaquimdeSousaAuthor

New Member

Hi @dingjerry_FTNT,

Thank you once again for all your advices. Sorry for the delay.

1. Following your advice, I changed the network range in the VPN to 255.255.255.0.
I suppose it must be the same as the LAN interface. But I may be wrong ?

2. I checked Nat Traversal and It's seems to be checked.

3. Here below are the screenshots for my FortiClient app and my FortiGate40F
FortiClient is is French.

Regards,
Jo

FORTIGATE40F & FORTICLIENT

dingjerry_FTNT

Staff

Hi @JoaquimdeSousa ,

Sorry, your screenshots are too small to read.

As per this KB:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-dial-up-full-tunnel-with-FortiClient/ta-p/189452

It seems that you may use /255.255.255.255. But please do not use the same network range as your internal interface.

dingjerry_FTNT

Staff

Hi @JoaquimdeSousa ,

You have to make sure that the FortiClient settings match the settings on FortiGate.

If it still does not work, you have to run the IKE debug commands.

JoaquimdeSousaAuthor

New Member

here is a better image : https://ibb.co/64t3c4z

dingjerry_FTNT

Staff

Hi @JoaquimdeSousa ,

Thanks. Some settings on FCT do not match the settings on FGT. Such as:

Proposals in Phase1 and Phase2;

DH group in Phase2;

You have to make sure that the address range in phase1 is not part of your internal network which you want to allow FCT clients to access.

So it's still better to run the IKE debug commands to collect outputs for further troubleshooting.

JoaquimdeSousaAuthor

New Member

Hello @dingjerry_FTNT

Sorry for the delay.
Unfortunately, The VPN still shows inactive.

Thanks for your help.
Kind Regards,
Jo
I send you hereby new screenshots and IKE debug commands Outputs

Reproductions following your advices
-------------------------------------------------

1. get at least one client connected -> it connects, but TimesOut after some seconds.

2. make FortiGate Phase 1 = FortiClient Phase 1 -> OK

3. capture screenshots
VPN-screenshot FortiGate40F and FortiClient = https://ibb.co/vdX2mVp

4. make sure that the Nat Traversal is enabled => OK

5. Why do I used /255.255.255.255 for the network range ?
-> I changed the Client Address Range to 255.255.255.0 - 10.0.0.1-10.0.0.254 -> https://ibb.co/vdX2mVp

6. do not use the same network range as your internal interface.
I changed it to 255.255.255.0 - 10.0.0.1-10.0.0.254
My internal interface is 192.168.1.1-192.168.1.254

6. CLI -> debug application ->
diag debug reset
diag debug application ike -1
diag debug enable

In the CLI below, at the END of the LOGS, before disconnecting, (if I'm guessing right) it tries to call back the client, but disconnects.

RESULTS:
-------------

diag debug reset
diag debug application ike -1
diag debug enable
diag vpn ike log-filter name vpn

ESQ7390 # ike shrank heap by 159744 bytes
ike 0: comes XXX.XXX.XXX.XXX:500->192.168.68.99:500,ifindex=5....
ike 0: IKEv1 exchange=Identity Protection id=8e4bdbe27e046fb7/0000000000000000 len=280
ike 0: in 8E4BDBE27E046FB700000000000000000110020000000000000001180D000064000000010000000100000058010100020300002801010000800B0001000C00040001518080010007800E00808003000180020004800400050000002802010000800B0001
000C00040001518080010007800E01008003000180020004800400050D0000144A131C81070358455C5728F20E95452F0D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D0000144C53427B6D465D1B337BB755A3
7A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E0D00001412F5F28C457168A9702D9FE274CC01000D00000C09002689DFD6B71200000014AFCAD71368A1F1C96B8696FC77570100
ike 0:8e4bdbe27e046fb7/0000000000000000:16: responder: main mode get 1st message...
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID RFC 3947 4A131C81070358455C5728F20E95452F
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID draft-ietf-ipsec-nat-t-ike-02 CD60464335DF21F87CFDB2FC68B6A448
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID forticlient connect license 4C53427B6D465D1B337BB755A37A7FEF
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID Fortinet Endpoint Control B4F01CA951E9DA8D0BAFBBD34AD3044E
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID draft-ietf-ipsra-isakmp-xauth-06.txt 09002689DFD6B712
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID DPD AFCAD71368A1F1C96B8696FC77570100
ike 0: cache rebuild start
ike 0: cache rebuild done
ike 0:8e4bdbe27e046fb7/0000000000000000:16: negotiation result
ike 0:8e4bdbe27e046fb7/0000000000000000:16: proposal id = 1:
ike 0:8e4bdbe27e046fb7/0000000000000000:16: protocol id = ISAKMP:
ike 0:8e4bdbe27e046fb7/0000000000000000:16: trans_id = KEY_IKE.
ike 0:8e4bdbe27e046fb7/0000000000000000:16: encapsulation = IKE/none
ike 0:8e4bdbe27e046fb7/0000000000000000:16: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128
ike 0:8e4bdbe27e046fb7/0000000000000000:16: type=OAKLEY_HASH_ALG, val=SHA2_256.
ike 0:8e4bdbe27e046fb7/0000000000000000:16: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:8e4bdbe27e046fb7/0000000000000000:16: type=OAKLEY_GROUP, val=MODP1536.
ike 0:8e4bdbe27e046fb7/0000000000000000:16: ISAKMP SA lifetime=86400
ike 0:8e4bdbe27e046fb7/0000000000000000:16: SA proposal chosen, matched gateway vpn
ike 0:vpn: created connection: 0x14778250 5 192.168.68.99->XXX.XXX.XXX.XXX:500.
ike 0:vpn:16: DPD negotiated
ike 0:vpn:16: XAUTHv6 negotiated
ike 0:vpn:16: peer supports UNITY
ike 0:vpn:16: enable FortiClient license check
ike 0:vpn:16: enable FortiClient endpoint compliance check, use 10.0.0.0
ike 0:vpn:16: selected NAT-T version: RFC 3947
ike 0:vpn:16: cookie 8e4bdbe27e046fb7/aeda7590e024c4d2
ike 0:vpn:16: out 8E4BDBE27E046FB7AEDA7590E024C4D20110020000000000000000DC0D00003C000000010000000100000030010100010000002801010000800B0001000C00040001518080010007800E00808003000180020004800400050D0000144A131C81
070358455C5728F20E95452F0D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E00
0000148299031757A36082C6A621DE00000000
ike 0:vpn:16: sent IKE msg (ident_r1send): 192.168.68.99:500->XXX.XXX.XXX.XXX:500, len=220, id=8e4bdbe27e046fb7/aeda7590e024c4d2
ike 0: comes XXX.XXX.XXX.XXX:500->192.168.68.99:500,ifindex=5....
ike 0: IKEv1 exchange=Identity Protection id=8e4bdbe27e046fb7/aeda7590e024c4d2 len=316
ike 0: in 8E4BDBE27E046FB7AEDA7590E024C4D204100200000000000000013C0A0000C4CA5880882B6476E8C7654B3A60076C47F1227601B996A81FCC91DB91DC88A9C73FBB2085FD2FB5A1C630EB50BA139B3DBD6FFA3BE28B6B8872608E2C44252FCA0944AF11
554AB4189DDA4A42CEAC9B21CD945D44AB95DEAADEF4FC26D9921CDF552278F594139FC21ED7881CD18DDB743A1CB2EFE18B3E2641FDE7BF1B328EE7E1D8144CBC06FC1F60C26FE0C2ACEBA5ABA9586EFBFFC1F7970B5E886B15CBC52EAA9C69503BF628874222E790
1DD1E5A46ACE81136DC0AFC16E628A9D0C064F14000014991C68CB7A4703E2D87BDF7384357E2114000024A68C3C6EC414E3C03616A359C5256D922858C7C9AB27E9194F551903F473E11E00000024B62B4EE52C24988E726421AC025DD39723DD1CCA515F08A8AFD0
1A64B463F1F4
ike 0:vpn:16: responder:main mode get 2nd message...
ike 0:vpn:16: received NAT-D payload type 20
ike 0:vpn:16: received NAT-D payload type 20
ike 0:vpn:16: NAT detected: ME PEER
ike 0:vpn:16: out 8E4BDBE27E046FB7AEDA7590E024C4D204100200000000000000013C0A0000C4677CF73F318452ABBF19A0E326D4C086645C42CF5A981D74578CC0E3B063DA2AD998F2311701A7B42D135C62859DF4540FCE41A0B04934B75D347AEE3937AD62
DB3DD884F9FAE11C3ADC5DE17D1DF4F72E1E4D8E07D6A1467F96924025389B0DEBD43D59AF9C873E1514A1AD11F8C23123C49D39CDA85C971821F150E95DE66DC7282DC0B4135D9263F56E1EF55DD6ECDA6296F44F8F8CFBC0C5F65EE8C220386FEDD0677D9BE63EAA
AB128383566536B70133729AC551A830551A37EE01D63E140000144DAEEAE5E945D34E120D294111B7F67114000024C0E2E82CD892FFAC008D623A5DEEDA758EBDDD7137681DEA4E55227AF6D80C16000000243530EC7F43ABD16B2C657764E940B1B348F8F742392C
CECDD9E45ABAC90D4A67
ike 0:vpn:16: sent IKE msg (ident_r2send): 192.168.68.99:500->XXX.XXX.XXX.XXX:500, len=316, id=8e4bdbe27e046fb7/aeda7590e024c4d2
ike 0:vpn:16: ISAKMP SA 8e4bdbe27e046fb7/aeda7590e024c4d2 key 16:6C3EB1C550FD3E04A81C9DB6C2CC1BE6
ike 0:vpn:16: out 8E4BDBE27E046FB7AEDA7590E024C4D204100200000000000000013C0A0000C4677CF73F318452ABBF19A0E326D4C086645C42CF5A981D74578CC0E3B063DA2AD998F2311701A7B42D135C62859DF4540FCE41A0B04934B75D347AEE3937AD62
DB3DD884F9FAE11C3ADC5DE17D1DF4F72E1E4D8E07D6A1467F96924025389B0DEBD43D59AF9C873E1514A1AD11F8C23123C49D39CDA85C971821F150E95DE66DC7282DC0B4135D9263F56E1EF55DD6ECDA6296F44F8F8CFBC0C5F65EE8C220386FEDD0677D9BE63EAA
AB128383566536B70133729AC551A830551A37EE01D63E140000144DAEEAE5E945D34E120D294111B7F67114000024C0E2E82CD892FFAC008D623A5DEEDA758EBDDD7137681DEA4E55227AF6D80C16000000243530EC7F43ABD16B2C657764E940B1B348F8F742392C
CECDD9E45ABAC90D4A67
ike 0:vpn:16: sent IKE msg (P1_RETRANSMIT): 192.168.68.99:500->XXX.XXX.XXX.XXX:500, len=316, id=8e4bdbe27e046fb7/aeda7590e024c4d2
ike 0:vpn:16: out 8E4BDBE27E046FB7AEDA7590E024C4D204100200000000000000013C0A0000C4677CF73F318452ABBF19A0E326D4C086645C42CF5A981D74578CC0E3B063DA2AD998F2311701A7B42D135C62859DF4540FCE41A0B04934B75D347AEE3937AD62
DB3DD884F9FAE11C3ADC5DE17D1DF4F72E1E4D8E07D6A1467F96924025389B0DEBD43D59AF9C873E1514A1AD11F8C23123C49D39CDA85C971821F150E95DE66DC7282DC0B4135D9263F56E1EF55DD6ECDA6296F44F8F8CFBC0C5F65EE8C220386FEDD0677D9BE63EAA
AB128383566536B70133729AC551A830551A37EE01D63E140000144DAEEAE5E945D34E120D294111B7F67114000024C0E2E82CD892FFAC008D623A5DEEDA758EBDDD7137681DEA4E55227AF6D80C16000000243530EC7F43ABD16B2C657764E940B1B348F8F742392C
CECDD9E45ABAC90D4A67
ike 0:vpn:16: sent IKE msg (P1_RETRANSMIT): 192.168.68.99:500->XXX.XXX.XXX.XXX:500, len=316, id=8e4bdbe27e046fb7/aeda7590e024c4d2
ike 0:vpn:16: out 8E4BDBE27E046FB7AEDA7590E024C4D204100200000000000000013C0A0000C4677CF73F318452ABBF19A0E326D4C086645C42CF5A981D74578CC0E3B063DA2AD998F2311701A7B42D135C62859DF4540FCE41A0B04934B75D347AEE3937AD62
DB3DD884F9FAE11C3ADC5DE17D1DF4F72E1E4D8E07D6A1467F96924025389B0DEBD43D59AF9C873E1514A1AD11F8C23123C49D39CDA85C971821F150E95DE66DC7282DC0B4135D9263F56E1EF55DD6ECDA6296F44F8F8CFBC0C5F65EE8C220386FEDD0677D9BE63EAA
AB128383566536B70133729AC551A830551A37EE01D63E140000144DAEEAE5E945D34E120D294111B7F67114000024C0E2E82CD892FFAC008D623A5DEEDA758EBDDD7137681DEA4E55227AF6D80C16000000243530EC7F43ABD16B2C657764E940B1B348F8F742392C
CECDD9E45ABAC90D4A67
ike 0:vpn:16: sent IKE msg (P1_RETRANSMIT): 192.168.68.99:500->XXX.XXX.XXX.XXX:500, len=316, id=8e4bdbe27e046fb7/aeda7590e024c4d2
ike 0:vpn:16: negotiation timeout, deleting
ike 0:vpn: connection expiring due to phase1 down
ike 0:vpn: deleting
ike 0:vpn: deleted

dingjerry_FTNT

Staff

Hi @JoaquimdeSousa ,

1) In IPSec Mode Config of phase1 settings, the subnet mask for the range is 255.255.255.255 according to the doc;

2) You enabled Split Tunneling but applied "all" for the range. That makes no difference with Full tunneling.

3) The VPN interface, do not use "10.0.0.0", you may use 10.0.0.2 since you used 10.0.0.1 for remote peer. And apply subnet mask /32 for it.

But I suggest you not use IPs from the same subnet for the dialup users as the VPN interface IPs.

If possible, could you please provide the FGT config?

BTW, how many IPSec VPN tunnels are there? If more than 2, are they all for dialup?

JoaquimdeSousaAuthor

New Member

Hello @dingjerry_FTNT

Sorry for the delay.
Unfortunately, The VPN still shows INACTIVE.

Thanks for your help.
Kind Regards,
Jo

I send you hereby IKE debug commands Outputs and FGT config.

Reproductions following your advices
---------------------------------------------------

1) In IPSec Mode Config of phase1 settings, the subnet mask for the range is 255.255.255.255 according to the doc;
-> OK, I understand.
In fact, when I first set up the VPN using the Wizard, it automatically assigned the subnet mask 255.255.255.255.

2) You enabled Split Tunneling but applied "all" for the range. That makes no difference with Full tunneling.
-> OK, Sorry,
I just set "LAN" access, instead of "All".

3) The VPN interface, do not use "10.0.0.0", you may use 10.0.0.2 since you used 10.0.0.1 for remote peer. And apply subnet mask /32 for it.
-> OK, I just set it to 10.0.0.2/32

4) But I suggest you not use IPs from the same subnet for the dialup users as the VPN interface IPs.
-> Can you please tell me where to change this ???

5) If possible, could you please provide the FGT config?
-> Here it is : https://pastebin.com/VSAPiD2A

6) BTW, how many IPSec VPN tunnels are there? If more than 2, are they all for dialup?
-> I only created 1 IPSec VPN tunnel
-> But there is this "Fortilink Aggregate" : https://ibb.co/DRPc0jp

7) IKE debug commands Outputs
-> https://pastebin.com/CBnUiR8k

Kind Regards,
Jo

dingjerry_FTNT

Staff

Hi @JoaquimdeSousa ,

It seems that everything on FGT is correct.

I assume your client is Windows based.

Could you please confirm whether you have Windows Firewall turned on or any third-party Anti-Virus software there? If yes, please turn them off all.

dingjerry_FTNTAnswer

Staff

And if possible, on your client, run WireShark to capture traffic on ports 500 or 4500.

JoaquimdeSousaAuthor

New Member

Hello @dingjerry_FTNT

Sorry for the delay. It WORKS, :collision::collision::collision:

First Thanks you so much for yours precious advices.

Yes, I use Windows FortiClient
The Windows FireWall is ON
Windows Defender On, no other anti-virus.

After capturing packets with WireShark, the problem was due to PORT 4500 which was closed.

I had to ask my ISP to open port 4500 UDP and now it works fine.

Kind Regards,
Jo :grinning_face:

dingjerry_FTNT

Staff

Hi @JoaquimdeSousa ,

I'm so glad to hear that it works for you now.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded