FortiClient IPSec Remote Access Connection issues.

[ABE_63]

I have been trying to create a local IPSec VPN connection (no connection through internet) as my previous attempts at getting it to work over the internet have not worked. I wanted to prove first that i can get it working without introducing the complexities of opening up ports on my edge firewall or contacting my ISP to troubleshoot. I configured the VPN to use Internal2 (port 2) as a WAN interface and i have connected an (offline, Windows Firewalls off) Windows machine (A) to this port with FC (FortiClient) installed. Having followed this video FortiGate Remote Access IPsec VPN (youtube.com) to create the IPSec tunnel, I tried to initiate a VPN connection to the Fortigate with no joy. I can ping the IP address i have given to internal2 from the machine A to prove connection. I have checked that both Phase 1 and 2 of the VPN config match on FW (version 7.4.1) and FC agent (version 7.2.2.0864).

I installed Wireshark on machine A and can see the pings appearing in the window for interface connected to internal2. But when i clear the log and restart the capture, Wireshark evidences that no packets are being sent from A when i press connect in FC. Yet when I enable my WiFi interface (which has no connection to Fortigate) to connect machine A to the internet, I do see traffic on the WiFi interface when i click connect in FC and i actually get an error message back from FC which says "IPSec VPN Connection is down". So do i have to be connected to the internet for this to work? Is there not an offline version I can use to evidence I can create a VPN connection and encrypt traffic?

[hbac]

Hi @ABE_63, 

So the Windows machine is directly connected to port2? It should work. Please run packet capture on the FortiGate: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Packet-Capture-on-FortiOS-GUI/ta-p/1...

If you see traffic coming from the Windows machine, you can collect ike debugs: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPSEC-Tunnel-debugging-IKE/ta-p/1900...

Regards, 

[ABE_63 · Accepted solution]

Hi @hbac,

Thanks for the reply. I have managed to resolve this issue. The problem was with the version of FortiClient I was using. I had to login to my fortiCloud account, go to the section where you can download firmware etc and download the FortiClient x64 version (not forticlientVPN) from there. The other version I had downloaded was from here Product Downloads | Fortinet Product Downloads | Support and was the VPN version which did not work. A bit misleading for a noob like me. I found that I also have to be connected to the internet on a second interface in order to establish a VPN connection to the firewall over a local Ethernet connection which seems strange. I'm guessing this has something to do with licensing.