FortiGate - Dial-UP-IPSEC Tunnel - Problem with TCP as transport mode

[michael2406]

Hello. I want to setup a dial up ipsec vpn tunnel from FortiClient to FortiGate. The tunnel is working with transport mode "udp" and port "500". 

When I change the transport mode in phase1-settings to "tcp" or "auto" and than use "tcp" in FortiClient, the FortiClient is running in an timeout. I have tested with local and sso users. Both same beahviour. I also tested different tcp ike-ports in "conf system settings". 

Any ideas?

FortiGate: 7.4.7

FortiClient: 7.4.2 

[Toshi_Esumi]

When I tried the same in similar environment, I encountered the same/similar issue. I opened a ticket to ask TAC. Then got this instruction to enable EAP.
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Using-IKEv2-for-a-dial-up-IPsec-tunn...
I indeed saw "gw validation failed" error in IKE debugging.

After that, it started working.

Toshi

[michael2406]

EAP is already enabled. 

[MZBZ]

Open a TAC ticket with logs according to: https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-Collecting-logs-for-addressing-VPN...

Also include packet captures from client and FortiGate side.

[michael2406]

Thank you. FortiGate see FSSO Login than no answer.

FortiClient Log says: "No response from the peer, phase1 retransmit reaches maximum count"

[michael2406]

Here is the log from FortiClient. Interesting thing: Why is it using port 500 even if I change it to tcp and 443?

Bug in FortiClient?

msg="No response from the peer, phase1 retransmit reaches maximum count" vpntunnel=test2 locip=192.XXX.XXX.XXX locport=500 remip=XX.XXX.XXX.XXX remport=500

[MZBZ]

Export FortiClient config and confirm the port+proto and check the values under Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FortiClient\IPSec\Tunnels 

[michael2406]

For me both is looking good. 

[MZBZ]

To address this issue, it's necessary to review the FortiGate and FortiClient configurations as well as the IKE debug logs. Because these contain confidential personal information, I strongly recommend opening a TAC ticket. Alternatively, you could share them here publicly, although this is not advisable.