Change from SSL VPN to IPSec >> cant connect to IPsec

[RolandBaumgaertner72]

Hello,

we just changed a FG cluster and we have FG90G with 7.4.7. I know that 7.4.8 does not support SSL VPN anymore so I guess we have no other option than changing from SSL VPN to IPSec.

I am trying to build up the IPSec connection same way like the SSL VPN but I cant connect. Of course standard IPSec DialUp connection is easy and always works but since we have a lot of Groups and I want to control them with Policies I dont get it running.

Incomming Interface is clear, the same and I know that it doesnt block any traffic

Client address range I use the same object SSL VPN range

Accessible Networks all since I also have to route them to Azure and our VPNs (like SSL VPN)

PSK I checked many times, this is 100% correct

XAUTH Inherit from Policy

So in the IPSec to LAN policy I just copied from SSL VPN the same range and my TEST User, destination and service all.

I try to connect but I get in the Client a failure of wrong credentials and than VPN connection failed, check configuration and network. Diag Sniffer on the FG and my public IP I see incommung UDP 500 and 4500 but nothing more.

In the FG I get Action negotiate , Status failure , Result XAUTH authentication failed

When i change the XAUTH and put a user Group with my Test User I get another failure delete IPsec phase 1 SA

Am I missing something since this was always an easy task?

Thanks!

[funkylicious]

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Do-not-use-the-same-IP-address-range-for-b... 

[RolandBaumgaertner72]

Hi,

I just tried with another range, SSL VPN with X.X.94.155-X.X.94.210 and IPSec with X.X.94.211-X.X.94.240 and I get the same mistake

[funkylicious]

are you using local user for connecting or a remote user from LDAP/RADIUS ?

can you post a sanitized configuration of your dialup ipsec configuration ?

[RolandBaumgaertner72]

Hi,

I want to user LDAP User but for testing I just put my local test user in this Group

What do you mean with sanitized?

Incomming Interface is clear, the same and I know that it doesnt block any traffic

Client address range NOW the new IPSec range which is differnet to the SSL VPN

Accessible Networks ALL since I also have to route them to Azure and our VPNs (like SSL VPN)

PSK I checked many times, this is 100% correct

XAUTH Inherit from Policy

[funkylicious]

sanitized meaning hiding any sensitive info like real public ip address, names, psk ...

xauth type is auto or something specific like pap, chap ?

[RolandBaumgaertner72]

OK:

config vpn ipsec phase1-interface
edit "XX IPSec"
set type dynamic
set interface "x2"
set mode aggressive
set peertype any
set net-device disable
set mode-cfg enable
set ipv4-dns-server1 X.1.98.80
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set comments "VPN: X IPSec (Created by VPN wizard)"
set wizard-type dialup-forticlient
set xauthtype auto
set authusrgrp "VPN SSL XX ALL"
set assign-ip-from name
set ipv4-netmask 255.255.255.0
set ipv4-split-include "all"
set ipv4-name "IPSEC_MZXX_range"
set save-password enable
set psksecret ENC fD1o5KotgytPa+L/eRjeiP/Lxp1By2VMySq6F8U+z4V/hUcDQN7ZGPVH5ArmOON9m1r84c5ODLGb5NJhE/yMdaTCwP4Cb78CQkS9DPpGrkKUBLyDyvLbyTw/CFMudpTCgaq17y0la8SFLM/5Ng312J4M1Vo8zbiCI5AXbNuBivHx2mrjfPySE4IKAdqDvLx+SEEWR1lmMjY3dkVA
next
end

[funkylicious]

i would suggest changing the netmask from /24 to /32 

if you are configuring user group in the ipsec configuration, in the firewall rules remove the group/user and just leave the range that users will be allocated

are there multiple ipsec dialup vpn's configured on this interface/device or is this the sole one ?

[RolandBaumgaertner72]

Ok I changed to /32 and removed the group in the policy but it would still not work.

Really strange!

I need the groups in the policies, as I said I would like to do the same as SSL VPN and we have like 7 different groups connecting via SSL VPN. It is so much easier than IPSec if you have something more complicated to connect.

[funkylicious]

understandable. in this case just unset the authusrgrp from cli or choose inherit from policy and use groups in the firewall policies.

can you start a debug and then connecting and maybe share the output here?

diag debug application fnbamd -1

diag debug console timestamp enable

diag debug application ike -1

diag debug enable