Ipsec connection in linux mint with strongswan

Hi

Try debug from FG side.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-VPNs-tunnels/ta-p/195955

Add leftauth2=xauth to ipsec.conf.

@AEK, unfortunately I don't have access to the server side :(

@strongX509, thank you! I made some progress with your suggestion!

Now, Microsoft Authenticator is providing me a pop up to approve the connection. However, although I approve it, the connection fails (and blocks my account due to repeated logins). Here is the new log:

initiating Aggressive Mode IKE_SA FortinetVPN[1] to VPN_IP_HERE generating AGGRESSIVE request 0 [ SA KE No ID V V V V V ] sending packet: from 10.0.2.15[500] to VPN_IP_HERE[500] (475 bytes) received packet: from VPN_IP_HERE[500] to 10.0.2.15[500] (540 bytes) parsed AGGRESSIVE response 0 [ SA KE No ID HASH V NAT-D NAT-D V V V V V ] received NAT-T (RFC 3947) vendor ID received DPD vendor ID received XAuth vendor ID received unknown vendor ID: 82:99:03:17:57:a3:60:82:c6:a6:21:de:00:00:00:00 received FRAGMENTATION vendor ID received FRAGMENTATION vendor ID selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536 local host is behind NAT, sending keep alives generating AGGRESSIVE request 0 [ HASH NAT-D NAT-D ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (140 bytes) received packet: from VPN_IP_HERE[4500] to 10.0.2.15[4500] (92 bytes) parsed TRANSACTION request 3430233041 [ HASH CPRQ(X_TYPE X_USER X_PWD) ] generating TRANSACTION response 3430233041 [ HASH CPRP(X_USER X_PWD) ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (108 bytes) received packet: from VPN_IP_HERE[4500] to 10.0.2.15[4500] (92 bytes) parsed TRANSACTION request 1880015101 [ HASH CPS(X_STATUS) ] XAuth authentication of 'My_User_name' (myself) successful IKE_SA FortinetVPN[1] established between 10.0.2.15[My_User_name]...VPN_IP_HERE[VPN_IP_HERE] scheduling reauthentication in 86049s maximum IKE_SA lifetime 86229s generating TRANSACTION response 1880015101 [ HASH CPA(X_STATUS) ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (92 bytes) generating QUICK_MODE request 1374538424 [ HASH SA No KE ID ID ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (428 bytes) received packet: from VPN_IP_HERE[4500] to 10.0.2.15[4500] (108 bytes) parsed INFORMATIONAL_V1 request 1850655511 [ HASH D ] received DELETE for IKE_SA FortinetVPN[1] deleting IKE_SA FortinetVPN[1] between 10.0.2.15[My_User_name]...VPN_IP_HERE[VPN_IP_HERE] initiating Aggressive Mode IKE_SA FortinetVPN[2] to VPN_IP_HERE establishing connection 'FortinetVPN' failed

From now on I have no clue, I suppose it has to do with the 2 factor authentication. The Windows Fortinet client "knows how to wait" until I approve the connection.

Hello @strongX509 ,

Indeed, the Windows 10 VPN client requests a virtual IP address to be used in the tunnel.

Here it is how it looks:

C:\Users\User>ipconfig /all  Windows IP Configuration  ...  Ethernet adapter Ethernet 2:     Connection-specific DNS Suffix  . : internal.company.com    Description . . . . . . . . . . . : Fortinet Virtual Ethernet Adapter (NDIS 6.30)    Physical Address. . . . . . . . . : 00-09-0F-FE-00-01    DHCP Enabled. . . . . . . . . . . : Yes    Autoconfiguration Enabled . . . . : Yes    Link-local IPv6 Address . . . . . : fe80::1665:5d42:d1c9:1f39%6(Preferred)    IPv4 Address. . . . . . . . . . . : 192.168.166.20(Preferred)    Subnet Mask . . . . . . . . . . . : 255.255.255.0    Lease Obtained. . . . . . . . . . : Tuesday, February 27, 2024 10:37:17    Lease Expires . . . . . . . . . . : Friday, April 4, 2160 17:10:18    Default Gateway . . . . . . . . . :    DHCP Server . . . . . . . . . . . : 192.168.166.21    DHCPv6 IAID . . . . . . . . . . . : 100665615    DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-28-F8-AD-E6-48-9E-BD-32-6B-C0    DNS Servers . . . . . . . . . . . : 172.28.2.111                                        172.28.2.111    NetBIOS over Tcpip. . . . . . . . : Enabled  ...  Ethernet adapter Ethernet 3:     Media State . . . . . . . . . . . : Media disconnected    Connection-specific DNS Suffix  . :    Description . . . . . . . . . . . : Fortinet SSL VPN Virtual Ethernet Adapter    Physical Address. . . . . . . . . : 00-09-0F-AA-00-01    DHCP Enabled. . . . . . . . . . . : Yes    Autoconfiguration Enabled . . . . : Yes

Thank you so much! Adding that line solved the connection issue, now it gets established:

initiating Aggressive Mode IKE_SA FortinetVPN[2] to VPN_IP_HERE generating AGGRESSIVE request 0 [ SA KE No ID V V V V V ] sending packet: from 10.0.2.15[500] to VPN_IP_HERE[500] (475 bytes) received packet: from VPN_IP_HERE[500] to 10.0.2.15[500] (540 bytes) parsed AGGRESSIVE response 0 [ SA KE No ID HASH V NAT-D NAT-D V V V V V ] received NAT-T (RFC 3947) vendor ID received DPD vendor ID received XAuth vendor ID received unknown vendor ID: 82:99:03:17:57:a3:60:82:c6:a6:21:de:00:00:00:00 received FRAGMENTATION vendor ID received FRAGMENTATION vendor ID selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536 local host is behind NAT, sending keep alives generating AGGRESSIVE request 0 [ HASH NAT-D NAT-D ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (140 bytes) received packet: from VPN_IP_HERE[4500] to 10.0.2.15[4500] (92 bytes) parsed TRANSACTION request 2940994650 [ HASH CPRQ(X_TYPE X_USER X_PWD) ] generating TRANSACTION response 2940994650 [ HASH CPRP(X_USER X_PWD) ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (108 bytes) received packet: from VPN_IP_HERE[4500] to 10.0.2.15[4500] (92 bytes) parsed TRANSACTION request 2519549645 [ HASH CPS(X_STATUS) ] XAuth authentication of 'My_User_name' (myself) successful IKE_SA FortinetVPN[2] established between 10.0.2.15[My_User_name]...VPN_IP_HERE[VPN_IP_HERE] scheduling reauthentication in 86049s maximum IKE_SA lifetime 86229s generating TRANSACTION response 2519549645 [ HASH CPA(X_STATUS) ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (92 bytes) generating TRANSACTION request 4259852066 [ HASH CPRQ(ADDR DNS) ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (92 bytes) received packet: from VPN_IP_HERE[4500] to 10.0.2.15[4500] (108 bytes) parsed TRANSACTION response 4259852066 [ HASH CPRP(ADDR DNS DNS) ] adding DNS server failed adding DNS server failed handling INTERNAL_IP4_DNS attribute failed adding DNS server failed handling INTERNAL_IP4_DNS attribute failed installing new virtual IP 192.168.166.20 generating QUICK_MODE request 4081831805 [ HASH SA No KE ID ID ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (428 bytes) received packet: from VPN_IP_HERE[4500] to 10.0.2.15[4500] (380 bytes) parsed QUICK_MODE response 4081831805 [ HASH SA No KE ID ID ] selected proposal: ESP:AES_CBC_256/HMAC_SHA1_96/MODP_1536/NO_EXT_SEQ CHILD_SA FortinetVPN{2} established with SPIs c60494e6_i acf989b7_o and TS 192.168.166.20/32 === 0.0.0.0/0 generating QUICK_MODE request 4081831805 [ HASH ] connection 'FortinetVPN' established successfully user@Machine:~$ sudo ipsec status FortinetVPN Security Associations (1 up, 0 connecting):  FortinetVPN[2]: ESTABLISHED 10 minutes ago, 10.0.2.15[My_User_name]...VPN_IP_HERE[VPN_IP_HERE]  FortinetVPN{2}:  INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c60494e6_i acf989b7_o  FortinetVPN{2}:   192.168.166.20/32 === 0.0.0.0/0

My question/problem now: The internet no longer works on my Linux machine as long as I have the VPN up. I can ping only internal IPs (but not access them via DNS). Anything from the outside cannot be reached or pinged.

The DNS servers do not seem to be set on linux.

@strongX509, you are right regarding the subnet. Thank you for your suggestion! Our VPN is used only for internal addresses. I removed the rightsubnet setting and now I can access external websites. However, it still fails to access internal DNS addresses, even the connect log says that. The resolve plugin seems to be loaded, I checked as you suggested. See the below log where I get messages such as:

adding DNS server failed
handling INTERNAL_IP4_DNS attribute failed

...

loaded plugins: charon ... resolve

user@Machine:~$ sudo ipsec up FortinetVPN  initiating Aggressive Mode IKE_SA FortinetVPN[1] to VPN_IP_HERE generating AGGRESSIVE request 0 [ SA KE No ID V V V V V ] sending packet: from 10.0.2.15[500] to VPN_IP_HERE[500] (475 bytes) received packet: from VPN_IP_HERE[500] to 10.0.2.15[500] (540 bytes) parsed AGGRESSIVE response 0 [ SA KE No ID HASH V NAT-D NAT-D V V V V V ] received NAT-T (RFC 3947) vendor ID received DPD vendor ID received XAuth vendor ID received unknown vendor ID: 82:99:03:17:57:a3:60:82:c6:a6:21:de:00:00:00:00 received FRAGMENTATION vendor ID received FRAGMENTATION vendor ID selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536 local host is behind NAT, sending keep alives generating AGGRESSIVE request 0 [ HASH NAT-D NAT-D ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (140 bytes) received packet: from VPN_IP_HERE[4500] to 10.0.2.15[4500] (92 bytes) parsed TRANSACTION request 2213304427 [ HASH CPRQ(X_TYPE X_USER X_PWD) ] generating TRANSACTION response 2213304427 [ HASH CPRP(X_USER X_PWD) ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (108 bytes) received packet: from VPN_IP_HERE[4500] to 10.0.2.15[4500] (92 bytes) parsed TRANSACTION request 4119683017 [ HASH CPS(X_STATUS) ] XAuth authentication of 'My_User_name' (myself) successful IKE_SA FortinetVPN[1] established between 10.0.2.15[My_User_name]...VPN_IP_HERE[VPN_IP_HERE] scheduling reauthentication in 86123s maximum IKE_SA lifetime 86303s generating TRANSACTION response 4119683017 [ HASH CPA(X_STATUS) ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (92 bytes) generating TRANSACTION request 1821253017 [ HASH CPRQ(ADDR DNS) ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (92 bytes) received packet: from VPN_IP_HERE[4500] to 10.0.2.15[4500] (108 bytes) parsed TRANSACTION response 1821253017 [ HASH CPRP(ADDR DNS DNS) ] adding DNS server failed adding DNS server failed handling INTERNAL_IP4_DNS attribute failed adding DNS server failed handling INTERNAL_IP4_DNS attribute failed installing new virtual IP 192.168.166.4 generating QUICK_MODE request 3418080153 [ HASH SA No KE ID ID ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (412 bytes) received packet: from VPN_IP_HERE[4500] to 10.0.2.15[4500] (364 bytes) parsed QUICK_MODE response 3418080153 [ HASH SA No KE ID ID ] selected proposal: ESP:AES_CBC_256/HMAC_SHA1_96/MODP_1536/NO_EXT_SEQ CHILD_SA FortinetVPN{1} established with SPIs c298834a_i acf98b43_o and TS 192.168.166.4/32 === VPN_IP_HERE/32 generating QUICK_MODE request 3418080153 [ HASH ] connection 'FortinetVPN' established successfully user@Machine:~$ sudo ipsec statusall Status of IKE charon daemon (strongSwan 5.9.5, Linux 5.15.0-97-generic, x86_64):   uptime: 3 minutes, since Feb 27 15:28:42 2024   malloc: sbrk 3076096, mmap 0, used 1393184, free 1682912   worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 4   loaded plugins: charon aesni aes rc2 sha2 sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm drbg attr kernel-netlink resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic counters Listening IP addresses:   10.0.2.15 Connections:  FortinetVPN:  %any...VPN_IP_HERE  IKEv1 Aggressive, dpddelay=30s  FortinetVPN:   local:  [My_User_name] uses pre-shared key authentication  FortinetVPN:   local:  [My_User_name] uses XAuth authentication: any  FortinetVPN:   remote: uses pre-shared key authentication  FortinetVPN:   child:  dynamic === dynamic TUNNEL, dpdaction=clear Security Associations (1 up, 0 connecting):  FortinetVPN[1]: ESTABLISHED 3 minutes ago, 10.0.2.15[My_User_name]...VPN_IP_HERE[VPN_IP_HERE]  FortinetVPN[1]: IKEv1 SPIs: 5cf2c9e9c58e5d5b_i* b083dddf32d19854_r, pre-shared key+XAuth reauthentication in 23 hours  FortinetVPN[1]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536  FortinetVPN{1}:  INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c298834a_i acf98b43_o  FortinetVPN{1}:  AES_CBC_256/HMAC_SHA1_96/MODP_1536, 0 bytes_i, 0 bytes_o, rekeying in 11 hours  FortinetVPN{1}:   192.168.166.4/32 === VPN_IP_HERE/32

Update: it seems that I was not having the resolveconf package on my linux system. After installing it, I no longer have those warnings related to DNS in my connection log:

user@Machine:~$ sudo ipsec up FortinetVPN initiating Aggressive Mode IKE_SA FortinetVPN[1] to VPN_IP_HERE generating AGGRESSIVE request 0 [ SA KE No ID V V V V V ] sending packet: from 10.0.2.15[500] to VPN_IP_HERE[500] (475 bytes) received packet: from VPN_IP_HERE[500] to 10.0.2.15[500] (540 bytes) parsed AGGRESSIVE response 0 [ SA KE No ID HASH V NAT-D NAT-D V V V V V ] received NAT-T (RFC 3947) vendor ID received DPD vendor ID received XAuth vendor ID received unknown vendor ID: 82:99:03:17:57:a3:60:82:c6:a6:21:de:00:00:00:00 received FRAGMENTATION vendor ID received FRAGMENTATION vendor ID selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536 local host is behind NAT, sending keep alives generating AGGRESSIVE request 0 [ HASH NAT-D NAT-D ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (140 bytes) received packet: from VPN_IP_HERE[4500] to 10.0.2.15[4500] (92 bytes) parsed TRANSACTION request 2243083556 [ HASH CPRQ(X_TYPE X_USER X_PWD) ] generating TRANSACTION response 2243083556 [ HASH CPRP(X_USER X_PWD) ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (108 bytes) received packet: from VPN_IP_HERE[4500] to 10.0.2.15[4500] (92 bytes) parsed TRANSACTION request 2838158151 [ HASH CPS(X_STATUS) ] XAuth authentication of 'My_User_name' (myself) successful IKE_SA FortinetVPN[1] established between 10.0.2.15[My_User_name]...VPN_IP_HERE[VPN_IP_HERE] scheduling reauthentication in 86120s maximum IKE_SA lifetime 86300s generating TRANSACTION response 2838158151 [ HASH CPA(X_STATUS) ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (92 bytes) generating TRANSACTION request 232585815 [ HASH CPRQ(ADDR DNS) ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (92 bytes) received packet: from VPN_IP_HERE[4500] to 10.0.2.15[4500] (108 bytes) parsed TRANSACTION response 232585815 [ HASH CPRP(ADDR DNS DNS) ] installing DNS server 172.28.2.111 via resolvconf DNS server 172.28.2.111 already installed, increasing refcount installing new virtual IP 192.168.166.4 generating QUICK_MODE request 4210871032 [ HASH SA No KE ID ID ] sending packet: from 10.0.2.15[4500] to VPN_IP_HERE[4500] (412 bytes) received packet: from VPN_IP_HERE[4500] to 10.0.2.15[4500] (364 bytes) parsed QUICK_MODE response 4210871032 [ HASH SA No KE ID ID ] selected proposal: ESP:AES_CBC_256/HMAC_SHA1_96/MODP_1536/NO_EXT_SEQ CHILD_SA FortinetVPN{1} established with SPIs cc656926_i acf98b6c_o and TS 192.168.166.4/32 === VPN_IP_HERE/32 connection 'FortinetVPN' established successfully

Now I also seem to have the DNS server installed, but pinging or accessing via browser internal addresses still does not work:

user@Machine:~$ ping something.internal.company.com ping: something.internal.company.com: Name or service not known

resolv.conf:

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) #     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN # 127.0.0.53 is the systemd-resolved stub resolver. # run "systemd-resolve --status" to see details about the actual nameservers.  nameserver 172.28.2.111 nameserver 127.0.0.53 options edns0 trust-ad

 I feel that I am getting very close to a final working vpn tunnel, but something little seems to be still missing.

Thank you very much for the help so far!

@AEK, yes 172.28.2.111 is the DNS server, I checked on the Windows 10 machine.

user@Machine:~$ sudo ufw status Status: inactive user@Machine:~$ dig something.internal.company.com @172.28.2.111 ;; communications error to 172.28.2.111#53: timed out ;; communications error to 172.28.2.111#53: timed out

It seems that it cannot access the DNS server on the 53 port, although the firewall is disabled (I ran sudo ufw disable previously). Any other thoughts? The OS is Linux Mint freshly installed in a Virtual Box machine. As I previously said, other external websites are being resolved properly, so it doesn't seem that port 53 would be blocked somehow.

user@Machine:~$ telnet 8.8.8.8 53 Trying 8.8.8.8... Connected to 8.8.8.8. Escape character is '^]'. ^CConnection closed by foreign host. user@Machine:~$ telnet 172.28.2.111 53 Trying 172.28.2.111... telnet: Unable to connect to remote host: Connection timed out

user@Machine:~$ route Kernel IP routing table Destination     Gateway         Genmask         Flags Metric Ref    Use Iface default         _gateway        0.0.0.0         UG    100    0        0 enp0s3 10.0.2.0        0.0.0.0         255.255.255.0   U     100    0        0 enp0s3 link-local      0.0.0.0         255.255.0.0     U     1000   0        0 enp0s3

@AEK, I don't have access on the remote FortiGate, but with the same credentials and using the FortiClient from Windows 10 it is properly working.

One difference between the 2 OS that I noticed is that in Windows 10 a new virtual adapter is created, which obtains a IPv4 address and a DHCP server (see my ipconfig /all command from the previous forum page).

In linux mint I don't have any other adapter created, even when the FortinetVPN connection is up (ifconfig command shows one wireless adapter and lo). Without a virtual interface I also don't have the routes set up, as you suggested (They are present in Windows 10, route print -4 command shows lots of entries with the fortinet virtual adapter)

So, going back to the ipsec.conf, maybe I am missing something there that prevents the creation of a virtual adapter? Or a linux package? Or is it strongswan in Linux somehow working differently than Fortinet Client in Windows 10?

Thank you all for the help provided so far!

@AEK, thank you so much!

Setting, as you suggested

rightsubnet=172.28.2.0/24

proved to be the working solution! Now I can ping and access internal websites, also using dns names!

When I check the route as you suggested it looks like in your example:

user@Machine:~$ ip route list table 220 172.28.2.0/24 via MY_ROUTER_IP dev enp0s3 proto static src 192.168.166.4

It still remains a mystery for me how Fortinet Windows 10 client knows how to properly without specifying this network and mask, but now I have a working client on my linux machine!

THANK YOU ALL!