Forticlient IPsec Tunnel on Android is not sending suitable Phase 1 and 2 proposals to my Firewall

[Potato]

Dear all,

We try to use a very week encryption method [IkeV1, Aggresive, DES-MD5, DH1 + XAuth] for the VPN setup,

that is what we expected.

We tried the config on Windows FortiClient, and the VPN is able to up with above method.

Then we tried the same setting for Android,

even we are able to select DES-MD5 DH1 and so on to match the config, the VPN is never up.

From the debug on Fortigate:

dia app ike -1

dia debug en

we observed that 3DES / AES connection was generated from the Android phone to Fortigate, so no proposal matched.

Why!? Is it a bug?

Thanks.

[scarletJEO036]

It sounds like you're encountering a compatibility issue between FortiClient on Android and the firewall configuration. While the VPN setup works fine on Windows, there may be specific limitations or differences in how Android handles Phase 1 and Phase 2 proposals, even when the same settings are selected. 

iPhone Repair

A few things to check:

1. FortiClient Version: Ensure that you're using the latest version of FortiClient for Android. Older versions might have limitations or bugs that prevent certain configurations from working correctly.

2. Encryption Strength: The encryption settings you're using (DES-MD5, DH1) are considered weak and outdated, which could be causing issues with the Android client. Some mobile devices may not support these older, less secure algorithms, especially if newer standards are enforced by the OS or app. Consider upgrading to stronger encryption methods like AES and SHA256 if possible.

3. XAuth Compatibility: Android devices may have issues with the XAuth configuration. You might want to test without XAuth or explore any specific settings related to XAuth in the FortiClient app for Android.

4. Firewall Configuration: Double-check the firewall settings to ensure that all Phase 1 and Phase 2 parameters are correctly defined and supported on both Windows and Android clients. It's possible that the firewall may not be fully compatible with the proposed settings for mobile clients.

5. Logs and Debugging: Review the FortiClient logs on Android for any error messages or clues. Additionally, check the firewall logs to see if there are any indications that the Phase 1 and Phase 2 proposals are being received but rejected, or if the issue lies elsewhere.

If these steps don’t resolve the issue, consider testing with different settings or a different VPN client on Android to confirm if the problem is specific to FortiClient on mobile devices.