Skip to main content
ehsangha
ehsangha
Explorer II
September 10, 2024
Question

IPSec Remote Access

  • September 10, 2024
  • 5 replies
  • 3165 views

Hi everyone.

I need to create two phase2  interfaces for IPSec Remote access to allow users to connect to two different subnets. I have created phase 1 and phase 2 interfaces, but the VPN connection failed.

 

config vpn ipsec phase1-interface
edit "IPsec_Clients"
set type dynamic
set interface "wan1"
set mode aggressive
set peertype any
set net-device enable
set mode-cfg enable
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set xauthtype auto
set authusrgrp "DC-VPN"
set ipv4-start-ip 172.16.17.129
set ipv4-end-ip 172.16.17.254
set ipv4-netmask 255.255.255.128
set dns-mode auto
set ipv4-split-include "IPsec_Clients_split"
set save-password enable
set psksecret ENC 2kvF93dFz+5UvJw0S50Bor9tCqr6vYz7pPR2fvGbrWd4W3cblxHIHxhyLTYFOYGM0l+bq65DpcnqU4ij5S3C0jKgglRrnnRbK1gLljGNYeR1C1OgVmJ3xuJMDxPBifR2FjFeZ8I8WzdaEuIg5Zx60CYvbuUCak80vyBcpzauEUyURIq56C7kguCO5AFJN/f4l8lffw==
next
end

config vpn ipsec phase2-interface
edit "IPsec_Clients"
set phase1name "IPsec_Clients"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set src-subnet 172.16.17.128 255.255.255.128
set dst-subnet 192.168.10.0 255.255.255.0
next
edit "IPsec_Clients1"
set phase1name "IPsec_Clients"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set src-subnet 172.16.17.128 255.255.255.128
set dst-subnet 192.168.9.0 255.255.255.0
next
end

 

5 replies

OmarUrquijo
OmarUrquijo
New Member
September 10, 2024

Hi @ehsangha can you share the error log ? 

ehsangha
ehsanghaAuthor
Explorer II
September 11, 2024

Hi 

ike 0: comes xxx.xxx.xxx.179:500->xxx.xxx.xxx.72:500,ifindex=7,vrf=0....
ike 0: IKEv1 exchange=Informational id=ad8f4dccb37dd3ec/e48f5c1030aef594:8aeb74a3 len=108 vrf=0
ike 0: in AD8F4DCCB37DD3ECE48F5C1030AEF594081005018AEB74A30000006CA19885F79AC9B5BE4AB4542FBEDB61E6FC6B15D11B32DB93DE795E467D335CE47572FA0C6AA7FC7A8BD6792A20EAE410434162A89903B5EF4768F11AA2823E35A9C09F972A53E0CCADB341F93F6C6A52
ike 0: no established IKE SA for exchange-type Informational from xxx.xxx.xxx.179:500->xxx.xxx.xxx.72 7 cookie ad8f4dccb37dd3ec/e48f5c1030aef594, drop
ike shrank heap by 4096 bytes

AEK
SuperUser
AEK
SuperUser
September 10, 2024

Hello

Which one fails? phase1 or phase2?

If you have access to FortiGate then please run these commands on the FGT, try to connect to IPsec, then share the output.

diag debug app ike -1
diag vpn ike log-filter name IPsec_Clients
diag debug enable
AEK
ehsangha
ehsanghaAuthor
Explorer II
September 10, 2024

Hi . phase 1 fails

nathan_h
Staff & Editor
nathan_h
Staff & Editor
September 10, 2024

Do you have an existing Dialup configured? Run the debug and see it is matching the correct Dialup tunnel. If it is possible you can share the IKE debug output.

FortiArt
Staff
FortiArt
Staff
September 10, 2024

You can use the dialup wizard and enable split-tunneling and defined the two destination subnets using the wizard. This allow users to have access to both subnets. You can also create 2 firewall polices each has different destination if the source groups of users are different however you need to define the groups to match firewall polices on tunnel configuration NOT on the tunnel itself.

 

Hope this help

ehsangha
ehsanghaAuthor
Explorer II
September 11, 2024

Hi 

ike 0: comes xxx.xxx.xxx.179:500->xxx.xxx.xxx.72:500,ifindex=7,vrf=0....
ike 0: IKEv1 exchange=Informational id=ad8f4dccb37dd3ec/e48f5c1030aef594:8aeb74a3 len=108 vrf=0
ike 0: in AD8F4DCCB37DD3ECE48F5C1030AEF594081005018AEB74A30000006CA19885F79AC9B5BE4AB4542FBEDB61E6FC6B15D11B32DB93DE795E467D335CE47572FA0C6AA7FC7A8BD6792A20EAE410434162A89903B5EF4768F11AA2823E35A9C09F972A53E0CCADB341F93F6C6A52
ike 0: no established IKE SA for exchange-type Informational from xxx.xxx.xxx.179:500->xxx.xxx.xxx.72 7 cookie ad8f4dccb37dd3ec/e48f5c1030aef594, drop
ike shrank heap by 4096 bytes

 

AEK
SuperUser
AEK
SuperUser
September 11, 2024

Hi

I don't think this is the right message you are looking for.

Try check phase1 config from both ends, make sure they match.

AEK
ehsangha
ehsanghaAuthor
Explorer II
September 11, 2024

I removed set ipv4-split-include  from Phase1-Interface, and now everything is OK. Would you please tell me what the reason is?

This is my Configuration: 

config vpn ipsec phase1-interface
edit "IPSec_Clients"
set type dynamic
set interface "wan1"
set local-gw xxx.xxx.xxx.xxx
set mode aggressive
set peertype any
set net-device disable
set mode-cfg enable
set ipv4-dns-server1 xxx.xxx.xxx.14
set proposal aes128-sha256
set dpd on-idle
set xauthtype auto
set authusrgrp "dara-vpn"
set nattraversal disable
set ipv4-start-ip 172.16.17.10
set ipv4-end-ip 172.16.17.254
set ipv4-netmask 255.255.255.0
set dpd-retryinterval 60
next

 

config vpn ipsec phase2-interface

edit "IPSec_Clients"
set phase1name "IPSec_Clients"
set proposal aes128-sha1
next
edit "IPSec_Clients1"
set phase1name "IPSec_Clients"
set proposal aes128-sha1
next

Terms & ConditionsAccessibility statement