Cannot Access outlook with IPSec VPN

[#1]

Hi All, Having issues in accessing the outlook when connected to IPSec VPN. I can ping the exchange server with IP and name and access other resources behind the Fortigate except this outlook issue. This was working fine before and stopped after upgrading the firmware. Any solution or workaround is appreciated.

[darrencarr]

Hi for_tech, Welcome to the forums. Can you please start by stating the firmware upgrade you were at, and where you are at now (after the upgrade). Also can you please list how you have defined your IPSec configuration, and any policies you have in place controlling the traffic between the IPSec tunnel and the interface your Outlook is behind. Also how to you access Outlook? Is it OWA over HTTPS?

[#3]

I have a same problem. both side using fortigate 80c. v4.0,build0194,100121 (MR1 Patch 3) Protection Profile : NO Traffic Shaping : YES ping exchange server is ok. other services ok also. webmail(exchange) also ok but cannot access outlook. i found the error message : 2010-02-25 18:11:52 log_id=0101037132 type=event subtype=ipsec pri=critical fwver=040003 vd=" root" msg=" IPsec ESP" action=" error" rem_ip=219.93.13.94 loc_ip=218.208.16.30 rem_port=500 loc_port=500 out_intf=" wan1" cookies=" 931d7735a1dbb530/559a4123940dce9b" user=" N/A" group=" N/A" xauth_user=" N/A" xauth_group=" N/A" vpn_tunnel=" KLANG" status=esp_error error_num=Invalid ESP packet detected (replayed packet). spi=19bf5862 seq=00037f8c 1 2010-02-25 18:25:42 critical ipsec 37132 error IPsec ESP 2 2010-02-25 18:11:52 critical ipsec 37132 error IPsec ESP 3 2010-02-25 18:08:02 critical ipsec 37132 error IPsec ESP 4 2010-02-25 18:07:38 critical ipsec 37132 error IPsec ESP 5 2010-02-25 17:59:05 critical ipsec 37132 error IPsec ESP 6 2010-02-25 17:58:20 critical ipsec 37132 error IPsec ESP 7 2010-02-25 17:47:32 critical ipsec 37132 error IPsec ESP 8 2010-02-25 17:42:28 critical ipsec 37132 error IPsec ESP 9 2010-02-25 17:40:18 critical ipsec 37132 error IPsec ESP 10 2010-02-25 17:34:07 critical ipsec 37132 error IPsec ESP 11 2010-02-25 17:33:12 critical ipsec 37132 error IPsec ESP 12 2010-02-25 17:24:07 critical ipsec 37132 error IPsec ESP ---------------------------------------------------------------------- ------------------------------------------------------------------------ vpn setting - 219.93.13.94 config vpn ipsec phase1 edit " FPSP" set interface " wan1" set proposal 3des-sha1 3des-md5 set remote-gw 218.208.16.30 set psksecret ENC ZTJ/Yx89+ErWAqj4oI0tKKjixh72ckt9H3waat/fkk4au+yAJWpc5QOlfKQ/OkyJy/Zk6tz8+Xg8mW6l0OZN4Zo9kY24Lkc8+pCiBaZ2nASeY2B8 next end config vpn ipsec phase2 edit " FPSP" set keepalive enable set phase1name " FPSP" set proposal 3des-sha1 3des-md5 set dst-subnet 192.1.4.0 255.255.255.0 set src-subnet 192.1.1.0 255.255.255.0 next end ----------------------------------------------------------------- vpn setting - 218.208.16.30 config vpn ipsec phase1 edit " KLANG" set interface " wan1" set proposal 3des-sha1 3des-md5 set remote-gw 219.93.13.94 set psksecret ENC bEJlGuehE9SgbsZoQJhj25Z6bb3EjGPGDkLnwdrHIE03fcwPXFQglzQLZuVSDSVvpSjdlkBOSR8FDiybs2QM5AXgxAfN7lGsYjSUUqsQ5xAEroar next end config vpn ipsec phase2 edit " KLANG" set keepalive enable set phase1name " KLANG" set proposal 3des-sha1 3des-md5 set dst-subnet 192.1.1.0 255.255.255.0 set src-subnet 192.1.4.0 255.255.255.0 next end ----------------------------------------------------------------

[#4]

google similiar problem. http://www.itsyourip.com/Windows/how-to-fix-exchange-outlook-connection-issues-over-ipsec-vpn/

[Phuoc_Ngo]

Anybody have solution for this on Fortigate? The link on reference Juniper. Thanks,

[#6]

1 2010-02-25 18:25:42 critical ipsec 37132 error IPsec ESP

Its something related with the Ipsec ESP error. An IPSec ESP notifcation. The error_num field contains one of the following: • esp err generic – Invalid ESP packet detected • esp err hmacl – Invalid ESP packet detected (HMAC validation failed) • esp err padding – Invalid ESP packet detected (invalid padding) • esp err padlen – Invliad ESP packet detected (invalid padding length) so double check the conf, or you may need tweak the conf again. IPSec site - to - site VPN Define the phase 1 parameters To define the phase 1 parameters - Go to VPN > IPSEC > Phase 1. - Select Create New, enter the following information, and select OK: Gateway Name Type a name for the remote gateway Remote Gateway: Static IP Address IP Address : remote FG external IP address Mode: Main Authentication Method: Preshared Key Pre-shared Key: Enter the preshared key. Peer Options Accept any peer ID Define the phase 2 parameters - Go to VPN > IPSEC > Phase 2. 2- Select Create New, enter the following information and select OK: Tunnel Name: Enter a name for the tunnel Phase 1 : Select the gateway that defined previously To define the IP source and destination addresses - Go to Firewall > Address > Address. - Select Create New Address Name: Enter an address name (source or destination) IP Range/Subnet: Enter the IP address of the network - Create the same for the destination address. Create a firewall policy from internal (define the created source address) to external (define the destination address) as IPSec with allow inbound and outbound access. - Apply the settings - Create the same settings on the second FG Monitor the IPSec Connection and bring to up. cheers,

[Phuoc_Ngo]

Site to site VPN work perfectly fine. The only problem we encounter is dial up VPN. Everything work perfect fine with the exception of Outlook client can' t communicate with the exchange server.

[#8]

ah, can you please check the split tunneling for the ipsec mobile vpn?? sound like there is something that not communicating with the smtp server. have you recently changed smtp server settings something like isolate smtp from the current network??

[Phuoc_Ngo]

We don' t use the split tunnel mode. Also there are no change to the setting on exchange server. The only change is that we upgrade to 4.0 MR1 patch3 (194). All traffic seem to work well under this firmware with the exception of outlook client.

[#10]

I believe that you can ping the exchange server from the ipsec vpn, while upgrading the firmware did you follow the release notes??? - have you try to revert the firmware to the previous version?