Question
Windows native VPN
Hello,
We have a use case in which we need to use the native Windows VPN client to connect to the Fortigate. I was able to successfully configure the VPN gateway and device tunnel. However, the issue now is that the Windows native client defaults to weak cryptography using DH group 2. If I try to specify anything stronger, it breaks the VPN connection.
I would like to add the following to my profile.xml file. When I add these lines, the VPN immediately disconnects and the only way to reconnect is to remove these lines and regenerate the device tunnel.
<CryptographySuite> <CipherTransformConstants>AES256</CipherTransformConstants> <EncryptionMethod>AES256</EncryptionMethod> <IntegrityCheckMethod>SHA384</IntegrityCheckMethod> <DHGroup>Group14</DHGroup> <PfsGroup>PFS2048</PfsGroup> <AuthenticationTransformConstants>SHA256128</AuthenticationTransformConstants>
For reference, I have these set up, respectively:
Phase 1:
aes256-sha512
aes256-sha384
DH groups 14 & 2
Phase 2:
aes256-sha1
aes256-sha384
aes256-sha256