How to get an IPsec VPN Tunnel with a Debian laptop?

Forum|Forum|2 years ago
May 27, 2024
4 replies
4366 views

Hi all,

We want to use IPsec VPN, and we have some Debian users. We have tried to use the package "strongswan" but we haven't succeeded to connect it. We want to use verification with ldap to authenticate and accept it.

In our FortiGate we have this configuration:

For the 1st phase:

For the 2nd phase:

In our Debian machine, we have tried this configuration:
In the ipsec.conf:

ipsec.conf.png

In the IPSec.secrets:

ipsec.secrets.png

In the updown.sh:

updown.sh.png

Here, it's the test of our configuration:

Do you have any idea about it?
Ali

spoojary

Staff

Does this doc help: https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-connection-between-FortiGate-and-Ubuntu-via/ta-p/207149

Debbie_FTNT

Staff & Editor

Hey AliE,

one thing that confuses me a bit is the peertype/peerid setting on FortiGate; with that in place, FortiGate would only accept connections from a client that provides that particular peerid during the tunnel setup, and the snippets from your debian environment do not include anything like that ID, as far as I can see.

Maybe remove that, set peertype 'any', and try again?

Please note that peertype 'any' can cause conflict if you have other VPNs listening on the same interface, in that case, do NOT try this!

Cheers,

Debbie

AliEAuthor

New Member

Hi,

Thank you for your response. I have rewrite the file "ipsec.conf" and now it's working!

conn hq         keyexchange = ikev1         ike = aes256-sha256-modp3072         #esp = aes256-sha256-modp3072          esp = aes256-sha256           aggressive = yes          right = 85.158.*.*         rightsubnet = 10.*.5.0/24         rightauth = psk          left = %defaultroute         leftsourceip=%config         leftauth = psk         leftauth2 = xauth         xauth_identity = test.vpn          auto = add         leftupdown = /usr/lib/ipsec/updown.sh

But now I have another problem...

When I'm connected, the different routes don't propagate but in windows with fortclient, I can receive these routes. I have enabled ipv4 split tunnel and create a book of addresses for "accesible networks".

Do you have an idea?

Ali