FortiClient IPSec VPN disconnects after around 20 seconds

[Ketanest]

Hi together,

acutally I am dealing on the following issue:

We tried to setup a remote IPSec VPN as SSL-VPN wont't be supported in the future.

The connection establishes, routes are configured on the client correctly. There are also packets sent from the client to the company network (packet counter is increasing) but no packets are received (packet counter is staying at 0).

On the Fortigate (acutally only a 40F for testing) the packets are shown in the capture and (e.g. a ping) also reaching the destination. The destination (e.g. DNS-Server) responds successfully and Fortigate sends the packet back into the tunnel (the packet capture shows this). But the packets are not received by the client.

After arount 20 seconds (+/- 5 seconds) the FortiClient ends the connection. But I think it is not really ending it, only killing it, as the connection stays in status "up" on the Forit for a while then.

Forti 40F has 7.4.7, Forticlient has Version 7.4.0.1658.

Config of Forti:

config vpn ipsec phase1-interface
    edit "vpn.remote"
        set type dynamic
        set interface "wan"
        set ip-version 6
        set keylife 14400
        set mode aggressive
        set peertype one
        set net-device disable
        set mode-cfg enable
        set ipv4-dns-server1 192.168.10.31
        set proposal aes256-sha512
        set dpd on-idle
        set dhgrp 21
        set xauthtype auto
        set nattraversal forced
        set peerid "vpn.remote"
        set assign-ip-from name
        set ipv4-name "N_VPN-Remote"
        set psksecret ENC "THISISVERYSECRET"
    next
end
config vpn ipsec phase2-interface
    edit "vpn.remote"
        set phase1name "vpn.remote"
        set proposal aes256-sha512
        set dhgrp 21
        set keylifeseconds 7200
    next
end

config firewall policy
    edit 6
        set name "Remote-VPN"
        set uuid 9a18dc24-4de5-51ef-100b-bd5e9bd00d97
        set srcintf "vpn.remote"
        set dstintf "IoT" "LAN" "VPN"
        set action accept
        set srcaddr "N_VPN-Remote"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set groups "VPN-Users"
    next
end

The Forticlient is configured accordingly (otherwise there won't be established a connection AFAIK).

We also tried with "set authusrgrp GROUPNAME" but also this won't work.

Hope you can maybe help me.

Thanks!

Ketanest

[kaman]

Hi Ketanest,

Kindly refer to the document below and share the output with us so we can verify the logs:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-troubleshoot-Intermittent-IPSec-Dia...

Regards,
Aman