Skip to main content
INT1
INT1
Explorer
Oct 18, 2024 10:29 AM UTC
Question

IPSEC VPN connection error

Hello, i have an error with connecting to IPSEC vpn IKEV2 using Azure AD email whats happening is after i get the pop up to enter the credenials after i enter and get the 2FA popup it says VPN connection is down and when i check the logs i get this error:

 image.png

i tried turning off the firewall on the device im trying to connect from, i restarted the services, removed and redownloaded the vpn and still nothing is changing 

15 replies

AEK
SuperUser
AEK
SuperUser
Oct 18, 2024 11:00 AM UTC

Hi INT1

Try run this on FG.

diagnose debug console timestamp enable

diagnose debug app ike -1

diagnose debug app fnbamd -1

diagnose debug

Translate
AEK
INT1
INT1Author
Explorer
Oct 18, 2024 11:44 AM UTC

to give abit mroe details there is no misconfiguration in the VPN IPSEC or anything related in the firewall but im having some issues with some users each different but this i couldn't find a solution to

Translate
Jz_FTNT
Staff
Jz_FTNT
Staff
Oct 23, 2024 12:31 AM UTC

you said some users having issues. Are those users using WiFi ? Does it make a difference if they switch to ethernet connection ?

Translate
AEK
SuperUser
AEK
SuperUser
Oct 19, 2024 9:30 PM UTC

So in summary, client says phase1 retransmit reaches maximum count, and server doesn' receive from client and says negotiation timeout.

In addition to Patel's suggestion (try using other ISP), you may also try using a stable FCT version, like 7.2.5 or 7.0.13.

Also you said the issue happens to some users. Is there any common thing between these users? Like they have Windows 11? Or a specific NIC driver? Or they are stored on other authentication server? Or anything else?

Translate
AEK
INT1
INT1Author
Explorer
Oct 21, 2024 11:57 AM UTC

we have tried doing it while connected on hotspot and it didnt work, what i have done is tried to connect using ssl and it went through but on ipsec its having a problem connecting for now this exact issue only happened on 1 device but there is some similar issues

 

Translate
tpatel
Staff
tpatel
Staff
Oct 21, 2024 8:44 PM UTC

Hello Int1, 

 

Run wireshark on user pc and also run packet capture on wan interface. Once vpn getting disconnect/failed compare packet leaving from fortigate wan interface to user public pc packet capture. 
check are you seen all packet. 

Translate
    INT1
    INT1Author
    Explorer
    Nov 1, 2024 7:54 AM UTC

    Hello, the issue is still haven't been solved till now i still cant put a finger on whats the problem, its only happening on ipsec. With ssl i can connect but trying with ipsec local user or SSO its causing an issue, we migrated from ipsec to ssl since the update and we only have ssl available for now on another firewall but we will change to IPSEC vpn

    Translate
    AEK
    SuperUser
    AEK
    SuperUser
    Nov 2, 2024 10:12 AM UTC

    Hi INT1.

    Does it give the same behavior when you disable MFA for IPsec?

    Translate
    AEK
    INT1
    INT1Author
    Explorer
    Nov 4, 2024 9:46 AM UTC

    i didnt try disabling MFA but i tried entering using a local user on fortigate and it was the same issue

     

    Translate
    Terms & ConditionsAccessibility statement
    Risk and Resilience in the Age of AI. An OT Thought Leadership Summit for Houston's Critical Infrastructure Leaders. Date: Thursday, December 3, 2026. Time: 8:30 am - 1:30 pm (CT). Location: The Westin Houston, Memorial City | 945 Gessner Road, Houston, TX 77024