Technical Tip: Remote IPsec VPN with FortiClient VPN in IOS devices

[ravisingh]

Description	This article describes how to create an IPsec VPN IKEv2 between FortiGate and FortiClient VPN in IOS devices.
Scope	FortiGate v7.2 and later; FortiClient VPN (including iOS/iPadOS, macOS, etc.).
Solution	In IOS native VPN settings, it is not possible to directly configure the IKEv2 encryption/integrity/PRF ciphers. FortiClient download link: Product Downloads | Fortinet Product Downloads | Support Related articles: Technical Tip: Apple IOS native VPN using IKEv2 connection for IPsec VPN to FortiGate Technical Tip: iPhone and iPad Dialup User IPsec VPN sample configuration  After completing the Remote IPsec VPN configuration on the FortiGate firewall, download the FortiClient VPN app on an iOS/iPadOS, macOS, etc. Open the FortiClient VPN application: Select 'Connection' and 'Add Configuration': Select 'Secure Protocol' as 'IKEV2 VPN' and provide 'Name' as the IPsec Remote VPN name configured on FortiGate. Mention the 'Server Address' as the interface IP of the IPsec VPN and set the same 'pre-shared key'. In case of remote IPsec VPN, select 'Secure Protocol' as 'SSL VPN'. Enable the EAP-Auth (Mandatory) and set Local and Remote Identifier (Optional): Select the phase1 and phase2 ciphers and Lifetime matching with FortiGate settings: Mention the username at the bottom and save the settings. Go back to the VPN first page and select 'Connect'. It will ask for the password for the username 'Mac-user'. It is now possible to connect to the Remote IPsec VPN. Note: If encountering issues connecting, ensure that the server address and credentials are correct. Check the network connection to ensure there is internet access. If using a corporate network, it is necessary to verify VPN permissions.  If the VPN connection issue persists, collect IKE debug logs for further troubleshooting: Troubleshooting Tip: IPsec VPN tunnels. Related documents: iOS device as dial-up client (iOS) Administration Guide Running FortiClient iOS