Failed to Establish IPSEC VPN with forti client

[#1]

Kindly help us to setup IPSEC VPN using the fort client running on the user’s laptops in SOHO ( behind Linksys NAT router at home). We have followed the VPN user guide but we failed. I have attached the client logs for your reference. The client home LAN private up: 192.168.11.173. Linksys NAT router :IPSEC pass-through : enabled : Forti Gate 200A WAN interface: y.y.y.y (public IP) Below are summary config of the IPSEC VPN: Phase 1: Remote gateway: dialup users Local interface: WAN ( y.y.y.y) Mode: main Peer option: accept any NAT_T: enabled Phase 2: Phase 1: selected the phase 1 created above. Policy based VPN firewall policy: Source interface : internal Source address: internal server address Destination interface: external Destination address: Any Action: IPSEC VPN Tunnel: Phase 1 tunnel name however, this is the main error i getting which failed to establish phase 1 case: <Type>Error <Time>3/21/2010 11:01:04 PM <Source>VPN program=ipsec msg=Failed to add vpn gateway Y.Y.Y.Y to trusted zone <Type>Warning <Time>3/21/2010 11:01:14 PM <Source>VPN loc_ip=192.168.11.173 loc_port=500 rem_ip=Y.Y.Y.Y rem_port=500 out_if=0 vpn_tunnel=forticlients status=negotiate_error msg=" No response from the peer, retransmit (st=1).... " appreciate your support.. as i feel down becuase i have tried every thing and still not working.. appreciate your helps guys

[#2]

the logs indicates there is some conf missing related to the peer settings. you can try these steps to configure the ipsec :- To create IPSec client VPN: - VPN- IPSec- under Auto key- create new phase 1 - Name - Remote gateway: dialup user - Local interface : select external interface - Mode : main - Authentication method : Preshared key - Leave the default settings under the advance - Apply the settings Create Phase-2 settings - name - Phase 1 : select the created Phase 1 - Leave the advance settings as default - Apply the settings - Create a firewall policy from internal to external as IPSec with allow inbound and outbound Client configuration:- - install the IPSec client software on systems - Go to VPN- connections and select add - In the connection name field, type a descriptive name for the connection - In the remote gateway field, type the public static IP/dynamic ID of the fortiGate unit - From the authentication method list, select Preshared Key - In the preshared key field, type the preshared key. The value must be identical to the preshared key that specified previously in the FG configuration - Leave the advance setting as default - Apply the settings - Repeat this procedure at all other remote hosts

[#3]

Thanks Mohammed for replying.. howe ever, i have tried that successfully and still not working... i have followed the VPN user guide line by line.!!. the main issue that i dont see the traffic reaching the fortigate.. when ever i go to the log access and check the logs i dont see any thing related to IPSEC. any ideas... i really dont know where im lost. does i have to do port forwarding on my linksys router for port 500 and 4500 to map it to my client PC 192.168.11.173 ? anyway i have also tried that and didnt work.

[#4]

in that case i assume it is something related with the linksys gateway. anyway you may try this one, disable IPSEC passthru and lets see.

[#5]

I Have disabled " IPSEC passthroug" on the linksys and below are the logs on Linksys: Mon, 2010-03-22 13:48:26 - UDP Packet - Source:X.X.X.X,500 Destination:Y.Y.Y.Y,500 - [Firewall Log-IPSecPass Fail] Mon, 2010-03-22 13:48:35 - UDP Packet - Source:X.X.X.X,500 Destination:Y.Y.Y.Y,500 - [Firewall Log-IPSecPass Fail] Mon, 2010-03-22 13:48:45 - UDP Packet - Source:X.X.X.X,500 Destination:Y.Y.Y.Y,500 - [Firewall Log-IPSecPass Fail] Mon, 2010-03-22 13:48:55 - UDP Packet - Source:X.X.X.X,500 Destination:Y.Y.Y.Y,500 - [Firewall Log-IPSecPass Fail]

[#6]

UDP Packet - Source:X.X.X.X,500 Destination:Y.Y.Y.Y,500 - [Firewall Log-IPSecPass Fail]

you could try this one http://www.tomsguide.com/us/how-to-vpn-firewall,review-139.html

[#7]

Dear i guess i found the issue.. the public ip address which im using was not used before and it was withen the block from my ISP. howe ever, i want to use that public address for VPN only. so how to make my public ip address active? do i have to create virtual IP or ? please help