PeerID/LocalID on IPSec client VPN

Which phase1 error do you have?

You can use debug command to see more details.

diagnose vpn ike log-filter YOUR-FILTER
diagnose debug application ike -1
diagnose debug console timestamp enable
diagnose debug enable

If I'm not wrong you don't need to configure Local ID on FGT, since it is not for FortiClient but for FGT to FGT tunnel.

I'm assuming the error you are getting is "gw validation failed" in IKE debugging.
When you use IKEv2 for remote access/dialup, you need to add a few commands in CLI to enable EAP as in the KB.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-fix-gw-validation-failed-error-IPsec-Dialup/ta-p/339644

Local ID on the FGT side can be configured under phase 1 proposal section. However, since FortiClient (7.4.x) side can not configure Peer ID, there is no use for the FGT side's local ID as long as you use FortiClient.

Also, with FGT/FortiClient, those peer ID/local ID are just a string. It doesn't have to be an IP address.

Toshi

Hi @EricS ,

I assume that the first screenshot is for FCT and the second one is for FortiGate IPSec VPN.

The FCT is using IKE v2 and FGT is using IKE v1.  They do not match.

 The following is from my FCT 7.2:

I can confirm that this is the same for FCT 7.4.

If you are using EMS, the following screenshot is from EMS:

@Toshi_Esumi @AEK The actual error in client is No response from the peer, phase1 retransmit reaches maximum count. In VPN FG log, the error is "progress IPsec phase 1" during SA_INIT.

@dingjerry_FTNTThe screenshots concern two differents IPSec VPN for Forticlient. The second is for information.

basically peer ids are used for identification.

You could (as I see you did in your  screenshots) limit one side to accept only a specfic id. Then the other side of the tunnel must have exactly this id as local id. Otherways the connection will be refused.

This is also very handy if you happen to have multiple ipsecs on one interface.

If you get a "no response from peer" you should check the ike log on the othe end to see what happened.