FortiClient Remote Access IPsec-over-TCP not working

[ryanswj]

Hi, I am running FortiOS 7.4.7 on a FortiGate-60F and am trying to migrate from SSLVPN to IPsec VPN.

I've managed to configure IPsec (IKEv2) dial-up to work fine, but I notice that when I set the mode to IPSec over TCP, FortiClient (v7.4.3) does not connect and times out. UDP mode works perfectly fine.

I also notice that TCP 4500 is not one of the local-in policies on the firewall.

Does a local-in policy need to be configured for this to work? Has anyone had any experience with this?

Thank you!

[Toshi_Esumi]

Ok, probably I mis-took your meaning of the word "not supported". The entire FortiClient VPN itself is "not supported" version of FortiClient any way.
At least above is my setting with 7.4.2 (now upgraded to 7.4.3) and working with FGT 7.4.7 IKEv2 config. I ran IKE debugging/Sniffing to confirm it's indeed connected over TCP.

Toshi

[MZBZ]

We have two FortiClient versions: FortiClient VPN only (standalone) and FortiClient which connects to EMS. IKEv2 over TCP is officially supported with the latter one.

FortiClient standalone and licensed version feature comparison | FortiClient 7.4.3 | Fortinet Docume...

[ryanswj]

I wanted to give an update on this.

I updated to 7.4.8 on 60F and it seems to work now. I can see 

transport: TCP

in diag vpn ike gateway list.

To anyone who is facing this issue, maybe upgrade to FortiOS 7.4.8 and try again?

[VictorT]

Hi @ryanswj Can you share your full config? phase1 and phase2. I have already upgraded to 7.4.8 and still facing the issue.

[nikriaz]

Nope. 80F 7.6.3 and free FortiClient 7.4.3.1790. Custom port 444.
In a sniffer I only see syn and ack. In IKE debug I only see there 3 lines.
Notice a timeout occurs in 18 seconds. 
Pretty hopeless.

[nikriaz]

I found on German reddit that people discovered that if on 7.6.x change standard port 443 to something else and then revert back to 443 it starts to work!

Unfortunately I can't test it because I have productive SSL behind FGT so I cannot use or even try standard 443 and it seems like non-standard port just does not work. 

[yderek]

Hi, @ryanswj 
Try below setting 

config system settings
    set ike-tcp-port 443

end

After that 

diagnose vpn ike restart 

This will restart current VPN instance, try move this activity after hours

And change the TCP port on FortiClient accordingly 

[nikriaz]

It does not help. Furthermore diagnose vpn ike restart nukes existed and working (non-TCP) connections by replacing polices by default ones even though it is not reflected in GUI, so experiment with caution. 

[kurtt]

Make sure if you are using 443 for IPSEC over TCP that you are also not using 443 for other daemons like proxy or admin interface. Does not matter what interface its bound to. Also if testing from a windows machine, make sure you have the latest visual C++ runtime installed or ipsec over TCP doesnt work. This seems dumb but this was our issue. I had tested from multiple windows machines and all had older versions of the runtime. It has to be the newest one available. You could confirm this by testing from a non windows machine. The behavior is as described, you get the ack reply and then nothing happens.

[MZBZ]

If you have issues with IPSec IKEv2 over TCP:

1. Make sure you are using FortiGate FortiOS 7.4.8+ or 7.6.3+

2. Test with TCP port other than 443 if you have issues with 443. Compare the result.

3. Wait for FortiClient 7.4.4/7.4.5

4. Contact Fortinet Technical Support with a valid FortiEMS license and ask for B6699 for tests and log collection.