IPSec Client Vpn

5 replies
102 views

I have a FortiGate VM deployed on Microsoft Azure, and I’m trying to configure an IPsec Client-to-Site VPN.

The current situation is:

* FortiGate VM is running on Azure.
* UDP 500 and UDP 4500 are allowed in the Azure Network Security Group (NSG) and Azure networking.
* The IPsec VPN client is able to reach the FortiGate.
* Phase 1 is established successfully.
* However, Phase 2 does not come up, and the VPN client cannot establish the VPN connection successfully.

I have already verified that UDP 500 and 4500 are allowed, but the issue still occurs.

My questions:

1. What are the most common reasons for IPsec Phase 2 failing on a FortiGate VM running on Azure when Phase 1 is already established?
2. Are there any Azure-specific requirements or settings that I should check for IPsec VPN, such as NSG rules, Public IP, routing, NAT-T, or IP forwarding?
3. What FortiGate debug commands would you recommend to identify why Phase 2 is failing?

Any guidance or troubleshooting steps would be highly appreciated.

funkylicious

SuperUser

here you can find some debug commands

make sure that you have:

a static route for the destination network(s)
firewall rule(s) for allowing the traffic
matching selectors if not using 0.0.0.0/0

other info should be displayed in the output when you run/enable the debugs

"jack of all trades, master of none"

M

M_samyAuthor

New Member

Already do it

funkylicious

SuperUser

scratch some of the stuff that i wrote, i misread that it’s a site 2 site vpn …

what kind of dialup vpn connection do you have? is it a ikev1 or a ikev2 ? what is the source of the authentication for the user? is the user locally / ldap / radius ?

"jack of all trades, master of none"