Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
systemgeek
Contributor II

Dialup IPSec VPN issues with Phase 1

FortiGate - 7.6.3

FortiClient - 7.2.9 (Windows and Mac)

 

I have been working with Support for weeks now with no success so hoping I can get help here.

Fortigate config:

config vpn ipsec phase1-interface
edit "OpsIPSecVPN"
set type dynamic
set interface "port1"
set ike-version 2
set peertype any
set net-device disable
set mode-cfg enable
set proposal des-sha512 aes256-sha512
set comments "VPN: OpsIPSecVPN -- Created by VPN wizard"
set dhgrp 14
set wizard-type dialup-forticlient
set nattraversal disable
set network-overlay enable
set network-id 0
set transport tcp
set fortinet-esp enable
set assign-ip-from name
set dns-mode auto
set ipv4-split-include "OpsIPSecVPN_split"
set ipv4-name "VPN_PCI_Operations_us2"
set save-password enable
set client-auto-negotiate enable
set client-keep-alive enable
set psksecret ENC ***

 

FortiClient config:

<connection>
<name>us2-LOACAL2</name>
<type>manual</type>
<ike_settings>
<keep_fqdn_resolution_consistency>0</keep_fqdn_resolution_consistency>
<version>2</version>
<eap_method>0</eap_method>
<sso_enabled>0</sso_enabled>
<ike_saml_port>0</ike_saml_port>
<use_external_browser>0</use_external_browser>
<fido_auth>0</fido_auth>
<prompt_certificate>0</prompt_certificate>
<description></description>
<server>vpn.example.com</server>
<authentication_method>Preshared Key</authentication_method>
<auth_key></auth_key>
<auth_data>
<preshared_key>Enc ********</preshared_key>
<certificate></certificate>
</auth_data>
<mode>aggressive</mode>
<dhgroup>14</dhgroup>
<key_life>86400</key_life>
<localid></localid>
<nat_traversal>0</nat_traversal>
<networkid>0</networkid>
<sase_mode>0</sase_mode>
<mode_config>1</mode_config>
<enable_local_lan>0</enable_local_lan>
<enable_ike_fragmentation>0</enable_ike_fragmentation>
<dpd>1</dpd>
<xauth>
<enabled>1</enabled>
<prompt_username>0</prompt_username>
<username>Enc XXXXXXXXX</username>
<password>Enc *********</password>
</xauth>
<proposals>
<proposal>DES|SHA512</proposal>
<proposal>AES256|SHA256</proposal>
</proposals>
<fgt>0</fgt>
</ike_settings>
<ipsec_settings>
<remote_networks></remote_networks>
<dhgroup>14</dhgroup>
<key_life_type>seconds</key_life_type>
<key_life_seconds>86400</key_life_seconds>
<key_life_Kbytes>5120</key_life_Kbytes>
<replay_detection>0</replay_detection>
<pfs>1</pfs>
<use_vip>1</use_vip>
<virtualip>
<type>modeconfig</type>
<ip></ip>
<mask></mask>
<dnsserver></dnsserver>
</virtualip>
<proposals>
<proposal>DES|SHA512</proposal>
<proposal>AES256|SHA256</proposal>
</proposals>
<ipv4_split_exclude_networks></ipv4_split_exclude_networks>
</ipsec_settings>
<on_connect>
<script>
<os>mac</os>
<script>$null</script>
</script>
</on_connect>
<on_disconnect>
<script>
<os>mac</os>
<script>$null</script>
</script>
</on_disconnect>
<tags>
<allowed></allowed>
<prohibited></prohibited>
</tags>
<host_check_fail_warning></host_check_fail_warning>
<keep_running>0</keep_running>
<disclaimer_msg>$null</disclaimer_msg>
<ui>
<show_passcode>0</show_passcode>
<show_remember_password>0</show_remember_password>
<show_alwaysup>0</show_alwaysup>
<show_autoconnect>0</show_autoconnect>
<save_username>0</save_username>
<save_password>0</save_password>
</ui>
</connection>
</connections>
</ipsecvpn>

Regardless of Encryption - Authentication on either side I get "no proposal chosen" "Negotiate SA Error".  Whats more interesting is what the Client seems to be sending to the FortiGate:

2025-05-13 14:53:35.412782 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: incoming proposal:
2025-05-13 14:53:35.412945 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: proposal id = 1:
2025-05-13 14:53:35.412951 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: protocol = IKEv2:
2025-05-13 14:53:35.413111 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: encapsulation = IKEv2/none
2025-05-13 14:53:35.413117 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: type=ENCR, val=AES_CBC (key_len = 256)
2025-05-13 14:53:35.413279 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: type=INTEGR, val=AUTH_HMAC_SHA2_512_256
2025-05-13 14:53:35.413284 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: type=PRF, val=PRF_HMAC_SHA
2025-05-13 14:53:35.413445 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: type=PRF, val=PRF_HMAC_SHA2_512
2025-05-13 14:53:35.413451 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: type=PRF, val=PRF_HMAC_SHA2_384
2025-05-13 14:53:35.413611 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: type=PRF, val=PRF_HMAC_SHA2_256
2025-05-13 14:53:35.413616 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: type=DH_GROUP, val=MODP2048.
2025-05-13 14:53:35.413950 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: proposal id = 2:
2025-05-13 14:53:35.414123 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: protocol = IKEv2:
2025-05-13 14:53:35.414128 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: encapsulation = IKEv2/none
2025-05-13 14:53:35.414299 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: type=ENCR, val=AES_CBC (key_len = 256)
2025-05-13 14:53:35.414304 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: type=INTEGR, val=AUTH_HMAC_SHA2_256_128
2025-05-13 14:53:35.414474 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: type=PRF, val=PRF_HMAC_SHA
2025-05-13 14:53:35.414478 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: type=PRF, val=PRF_HMAC_SHA2_512
2025-05-13 14:53:35.414483 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: type=PRF, val=PRF_HMAC_SHA2_384
2025-05-13 14:53:35.414487 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: type=PRF, val=PRF_HMAC_SHA2_256
2025-05-13 14:53:35.414492 ike V=root:0:6bbf3efb5a59b188/0000000000000000:690: type=DH_GROUP, val=MODP2048.

 

The first part of that incoming proposal says IKEv2 with AES_CBC key length 256, SHA512.  But where is DES since thats the first option in the client.  The proposal from the FortiGate does say val=DES_CBC.

 

To me this is say that the ForitClient is ignoring the config when sending the proposal.

 

Has anyone else seen this????

 

 

1 Solution
funkylicious
SuperUser
SuperUser

i assume that you are trying to do ipsec w/ tcp and ikev2.

try using at least FortiClient 7.4.1 which would support this setup and choose only 1 set of params for phase1, dont enable/configure multiple options.

 

have a look at this also, https://community.fortinet.com/t5/Support-Forum/FortiClient-Remote-Access-IPsec-over-TCP-not-working... 

"jack of all trades, master of none"

View solution in original post

"jack of all trades, master of none"
4 REPLIES 4
funkylicious
SuperUser
SuperUser

i assume that you are trying to do ipsec w/ tcp and ikev2.

try using at least FortiClient 7.4.1 which would support this setup and choose only 1 set of params for phase1, dont enable/configure multiple options.

 

have a look at this also, https://community.fortinet.com/t5/Support-Forum/FortiClient-Remote-Access-IPsec-over-TCP-not-working... 

"jack of all trades, master of none"
"jack of all trades, master of none"
systemgeek

I read through that doc you posted.  I can say that with FortiOS 7.6.3 FCT 7.2.9 and 7.4.3 setting the Encapsulation on the client to IKE UDP port 4500 gets a response on the FGT.  The same is true with Auto.  However, IPSec over TCP never makes it to the FGT.  I think its doing a retransmission when set to IPSec over TCP.

 

I do not know anything about FCT 7.4.8 which was mentioned in that doc.

funkylicious

FortiOS 7.4.8 is to be available this month if i understood correctly

"jack of all trades, master of none"
"jack of all trades, master of none"
systemgeek

Waiting with bated breath...  

Announcements
Check out our Community Chatter Blog! Click here to get involved
Labels
Top Kudoed Authors