Technical Tip: Unable to get FortiToken Cloud push to work while using an IPsec VPN, 'fnbam request ID XXXXXXXXXXXX unknown' is seen in the debug

[johnathan]

Description	This article describes why FortiToken Cloud is not working while using an IPsec VPN. The event 'fnbam request ID XXXXXXXXXXXX unknown' is seen in the debug logs.
Scope	FortiGate, FortiToken Cloud.
Solution	When using the FortiToken Cloud push, the tunnel must be configured with IKEv2. If the tunnel is in IKEv1, the user can accept the push in the FortiClient, the FortiToken Cloud logs will show as accepted, but the tunnel will still refuse to connect as IKEv1 will not support push notifications. If IKEv1 is necessary to use, push notifications should be disabled. The following article describes how to disable the push notification for FortiToken Cloud deployment: Technical Tip: How to disable the push notification for a FortiToken Cloud deployment. When running the following debug commands, 'fnbam request ID XXXXXXXXXXXX unknown' will be seen: diagnose debug reset diagnose debug app ike -1  diagnose debug enable The following is an example of this output: Note:  Push notification set-up over dial-up is supported only starting with v7.2.8, v7.4.4, v7.6.0, and below FortiClient versions: v7.2.4 and above for Windows. v7.2.5 and above for MAC. v7.2.5 and above for Linux.