Fortinet tunnel is showing inactive state

[JoaquimdeSousa]

Hello All,

I have this issue. FortiGate 40F (v6.4.15 build2095)

Fortinet tunnel is showing inactive state

Reproduction : I use the GUI not the CLI.

1. I created a vpn user

2. I assigned this user to a vpn group

3. I used th VPN wizard to create an Dialup FortiClient (Windows, Mac OS, Android) :
-> https://docs.fortinet.com/document/fortigate/6.4.15/administration-guide/785501/forticlient-as-dialu...

4. In Firewall & Objects
-> Addresses :
-> Created automatically -> vpn1_range = 192.168.1.1-192.168.1.254
-> Created automatically -> vpn1_split = members = lan
-> Firewall Policy :
-> Created automatically -> vpn_vpn1_remote_0

-> The VPN was created, but shows INACTIVE.

I really don't understand. Can some help, please ?

Kind Regards,
Jo

[dingjerry_FTNT]

Hi @JoaquimdeSousa ,

You have to make sure that the FortiClient settings match the settings on FortiGate.

If it still does not work, you have to run the IKE debug commands.

[JoaquimdeSousa]

here is a better image : https://ibb.co/64t3c4z

[dingjerry_FTNT]

Hi @JoaquimdeSousa ,

Thanks. Some settings on FCT do not match the settings on FGT. Such as: 

Proposals in Phase1 and Phase2;

DH group in Phase2;

You have to make sure that the address range in phase1 is not part of your internal network which you want to allow FCT clients to access.

So it's still better to run the IKE debug commands to collect outputs for further troubleshooting.

[JoaquimdeSousa]

Hello @dingjerry_FTNT

Sorry for the delay.
Unfortunately, The VPN still shows inactive.

Thanks for your help.
Kind Regards,
Jo
I send you hereby new screenshots and IKE debug commands Outputs

Reproductions following your advices
-------------------------------------------------

1. get at least one client connected -> it connects, but TimesOut after some seconds.

2. make FortiGate Phase 1 = FortiClient Phase 1 -> OK

3. capture screenshots
VPN-screenshot FortiGate40F and FortiClient = https://ibb.co/vdX2mVp

4. make sure that the Nat Traversal is enabled => OK

5. Why do I used /255.255.255.255 for the network range ?
-> I changed the Client Address Range to 255.255.255.0 - 10.0.0.1-10.0.0.254 -> https://ibb.co/vdX2mVp

6. do not use the same network range as your internal interface.
I changed it to 255.255.255.0 - 10.0.0.1-10.0.0.254
My internal interface is 192.168.1.1-192.168.1.254

6. CLI -> debug application ->
diag debug reset
diag debug application ike -1
diag debug enable

In the CLI below, at the END of the LOGS, before disconnecting, (if I'm guessing right) it tries to call back the client, but disconnects.

RESULTS:
-------------

diag debug reset
diag debug application ike -1
diag debug enable
diag vpn ike log-filter name vpn

ESQ7390 # ike shrank heap by 159744 bytes
ike 0: comes XXX.XXX.XXX.XXX:500->192.168.68.99:500,ifindex=5....
ike 0: IKEv1 exchange=Identity Protection id=8e4bdbe27e046fb7/0000000000000000 len=280
ike 0: in 8E4BDBE27E046FB700000000000000000110020000000000000001180D000064000000010000000100000058010100020300002801010000800B0001000C00040001518080010007800E00808003000180020004800400050000002802010000800B0001
000C00040001518080010007800E01008003000180020004800400050D0000144A131C81070358455C5728F20E95452F0D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D0000144C53427B6D465D1B337BB755A3
7A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E0D00001412F5F28C457168A9702D9FE274CC01000D00000C09002689DFD6B71200000014AFCAD71368A1F1C96B8696FC77570100
ike 0:8e4bdbe27e046fb7/0000000000000000:16: responder: main mode get 1st message...
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID RFC 3947 4A131C81070358455C5728F20E95452F
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID draft-ietf-ipsec-nat-t-ike-02 CD60464335DF21F87CFDB2FC68B6A448
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID forticlient connect license 4C53427B6D465D1B337BB755A37A7FEF
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID Fortinet Endpoint Control B4F01CA951E9DA8D0BAFBBD34AD3044E
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID draft-ietf-ipsra-isakmp-xauth-06.txt 09002689DFD6B712
ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID DPD AFCAD71368A1F1C96B8696FC77570100
ike 0: cache rebuild start
ike 0: cache rebuild done
ike 0:8e4bdbe27e046fb7/0000000000000000:16: negotiation result
ike 0:8e4bdbe27e046fb7/0000000000000000:16: proposal id = 1:
ike 0:8e4bdbe27e046fb7/0000000000000000:16: protocol id = ISAKMP:
ike 0:8e4bdbe27e046fb7/0000000000000000:16: trans_id = KEY_IKE.
ike 0:8e4bdbe27e046fb7/0000000000000000:16: encapsulation = IKE/none
ike 0:8e4bdbe27e046fb7/0000000000000000:16: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128
ike 0:8e4bdbe27e046fb7/0000000000000000:16: type=OAKLEY_HASH_ALG, val=SHA2_256.
ike 0:8e4bdbe27e046fb7/0000000000000000:16: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:8e4bdbe27e046fb7/0000000000000000:16: type=OAKLEY_GROUP, val=MODP1536.
ike 0:8e4bdbe27e046fb7/0000000000000000:16: ISAKMP SA lifetime=86400
ike 0:8e4bdbe27e046fb7/0000000000000000:16: SA proposal chosen, matched gateway vpn
ike 0:vpn: created connection: 0x14778250 5 192.168.68.99->XXX.XXX.XXX.XXX:500.
ike 0:vpn:16: DPD negotiated
ike 0:vpn:16: XAUTHv6 negotiated
ike 0:vpn:16: peer supports UNITY
ike 0:vpn:16: enable FortiClient license check
ike 0:vpn:16: enable FortiClient endpoint compliance check, use 10.0.0.0
ike 0:vpn:16: selected NAT-T version: RFC 3947
ike 0:vpn:16: cookie 8e4bdbe27e046fb7/aeda7590e024c4d2
ike 0:vpn:16: out 8E4BDBE27E046FB7AEDA7590E024C4D20110020000000000000000DC0D00003C000000010000000100000030010100010000002801010000800B0001000C00040001518080010007800E00808003000180020004800400050D0000144A131C81
070358455C5728F20E95452F0D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E00
0000148299031757A36082C6A621DE00000000
ike 0:vpn:16: sent IKE msg (ident_r1send): 192.168.68.99:500->XXX.XXX.XXX.XXX:500, len=220, id=8e4bdbe27e046fb7/aeda7590e024c4d2
ike 0: comes XXX.XXX.XXX.XXX:500->192.168.68.99:500,ifindex=5....
ike 0: IKEv1 exchange=Identity Protection id=8e4bdbe27e046fb7/aeda7590e024c4d2 len=316
ike 0: in 8E4BDBE27E046FB7AEDA7590E024C4D204100200000000000000013C0A0000C4CA5880882B6476E8C7654B3A60076C47F1227601B996A81FCC91DB91DC88A9C73FBB2085FD2FB5A1C630EB50BA139B3DBD6FFA3BE28B6B8872608E2C44252FCA0944AF11
554AB4189DDA4A42CEAC9B21CD945D44AB95DEAADEF4FC26D9921CDF552278F594139FC21ED7881CD18DDB743A1CB2EFE18B3E2641FDE7BF1B328EE7E1D8144CBC06FC1F60C26FE0C2ACEBA5ABA9586EFBFFC1F7970B5E886B15CBC52EAA9C69503BF628874222E790
1DD1E5A46ACE81136DC0AFC16E628A9D0C064F14000014991C68CB7A4703E2D87BDF7384357E2114000024A68C3C6EC414E3C03616A359C5256D922858C7C9AB27E9194F551903F473E11E00000024B62B4EE52C24988E726421AC025DD39723DD1CCA515F08A8AFD0
1A64B463F1F4
ike 0:vpn:16: responder:main mode get 2nd message...
ike 0:vpn:16: received NAT-D payload type 20
ike 0:vpn:16: received NAT-D payload type 20
ike 0:vpn:16: NAT detected: ME PEER
ike 0:vpn:16: out 8E4BDBE27E046FB7AEDA7590E024C4D204100200000000000000013C0A0000C4677CF73F318452ABBF19A0E326D4C086645C42CF5A981D74578CC0E3B063DA2AD998F2311701A7B42D135C62859DF4540FCE41A0B04934B75D347AEE3937AD62
DB3DD884F9FAE11C3ADC5DE17D1DF4F72E1E4D8E07D6A1467F96924025389B0DEBD43D59AF9C873E1514A1AD11F8C23123C49D39CDA85C971821F150E95DE66DC7282DC0B4135D9263F56E1EF55DD6ECDA6296F44F8F8CFBC0C5F65EE8C220386FEDD0677D9BE63EAA
AB128383566536B70133729AC551A830551A37EE01D63E140000144DAEEAE5E945D34E120D294111B7F67114000024C0E2E82CD892FFAC008D623A5DEEDA758EBDDD7137681DEA4E55227AF6D80C16000000243530EC7F43ABD16B2C657764E940B1B348F8F742392C
CECDD9E45ABAC90D4A67
ike 0:vpn:16: sent IKE msg (ident_r2send): 192.168.68.99:500->XXX.XXX.XXX.XXX:500, len=316, id=8e4bdbe27e046fb7/aeda7590e024c4d2
ike 0:vpn:16: ISAKMP SA 8e4bdbe27e046fb7/aeda7590e024c4d2 key 16:6C3EB1C550FD3E04A81C9DB6C2CC1BE6
ike 0:vpn:16: out 8E4BDBE27E046FB7AEDA7590E024C4D204100200000000000000013C0A0000C4677CF73F318452ABBF19A0E326D4C086645C42CF5A981D74578CC0E3B063DA2AD998F2311701A7B42D135C62859DF4540FCE41A0B04934B75D347AEE3937AD62
DB3DD884F9FAE11C3ADC5DE17D1DF4F72E1E4D8E07D6A1467F96924025389B0DEBD43D59AF9C873E1514A1AD11F8C23123C49D39CDA85C971821F150E95DE66DC7282DC0B4135D9263F56E1EF55DD6ECDA6296F44F8F8CFBC0C5F65EE8C220386FEDD0677D9BE63EAA
AB128383566536B70133729AC551A830551A37EE01D63E140000144DAEEAE5E945D34E120D294111B7F67114000024C0E2E82CD892FFAC008D623A5DEEDA758EBDDD7137681DEA4E55227AF6D80C16000000243530EC7F43ABD16B2C657764E940B1B348F8F742392C
CECDD9E45ABAC90D4A67
ike 0:vpn:16: sent IKE msg (P1_RETRANSMIT): 192.168.68.99:500->XXX.XXX.XXX.XXX:500, len=316, id=8e4bdbe27e046fb7/aeda7590e024c4d2
ike 0:vpn:16: out 8E4BDBE27E046FB7AEDA7590E024C4D204100200000000000000013C0A0000C4677CF73F318452ABBF19A0E326D4C086645C42CF5A981D74578CC0E3B063DA2AD998F2311701A7B42D135C62859DF4540FCE41A0B04934B75D347AEE3937AD62
DB3DD884F9FAE11C3ADC5DE17D1DF4F72E1E4D8E07D6A1467F96924025389B0DEBD43D59AF9C873E1514A1AD11F8C23123C49D39CDA85C971821F150E95DE66DC7282DC0B4135D9263F56E1EF55DD6ECDA6296F44F8F8CFBC0C5F65EE8C220386FEDD0677D9BE63EAA
AB128383566536B70133729AC551A830551A37EE01D63E140000144DAEEAE5E945D34E120D294111B7F67114000024C0E2E82CD892FFAC008D623A5DEEDA758EBDDD7137681DEA4E55227AF6D80C16000000243530EC7F43ABD16B2C657764E940B1B348F8F742392C
CECDD9E45ABAC90D4A67
ike 0:vpn:16: sent IKE msg (P1_RETRANSMIT): 192.168.68.99:500->XXX.XXX.XXX.XXX:500, len=316, id=8e4bdbe27e046fb7/aeda7590e024c4d2
ike 0:vpn:16: out 8E4BDBE27E046FB7AEDA7590E024C4D204100200000000000000013C0A0000C4677CF73F318452ABBF19A0E326D4C086645C42CF5A981D74578CC0E3B063DA2AD998F2311701A7B42D135C62859DF4540FCE41A0B04934B75D347AEE3937AD62
DB3DD884F9FAE11C3ADC5DE17D1DF4F72E1E4D8E07D6A1467F96924025389B0DEBD43D59AF9C873E1514A1AD11F8C23123C49D39CDA85C971821F150E95DE66DC7282DC0B4135D9263F56E1EF55DD6ECDA6296F44F8F8CFBC0C5F65EE8C220386FEDD0677D9BE63EAA
AB128383566536B70133729AC551A830551A37EE01D63E140000144DAEEAE5E945D34E120D294111B7F67114000024C0E2E82CD892FFAC008D623A5DEEDA758EBDDD7137681DEA4E55227AF6D80C16000000243530EC7F43ABD16B2C657764E940B1B348F8F742392C
CECDD9E45ABAC90D4A67
ike 0:vpn:16: sent IKE msg (P1_RETRANSMIT): 192.168.68.99:500->XXX.XXX.XXX.XXX:500, len=316, id=8e4bdbe27e046fb7/aeda7590e024c4d2
ike 0:vpn:16: negotiation timeout, deleting
ike 0:vpn: connection expiring due to phase1 down
ike 0:vpn: deleting
ike 0:vpn: deleted

[dingjerry_FTNT]

Hi @JoaquimdeSousa ,

1) In IPSec Mode Config of phase1 settings, the subnet mask for the range is 255.255.255.255 according to the doc;

2) You enabled Split Tunneling but applied "all" for the range. That makes no difference with Full tunneling.

3) The VPN interface, do not use "10.0.0.0",  you may use 10.0.0.2 since you used 10.0.0.1 for remote peer.  And apply subnet mask /32 for it.

But I suggest you not use IPs from the same subnet for the dialup users as the VPN interface IPs.

If possible, could you please provide the FGT config?

BTW, how many IPSec VPN tunnels are there? If more than 2, are they all for dialup? 

[dingjerry_FTNT]

It's better to capture the IKE debugs again without this command "diag vpn ike log-filter name vpn". I suspect that you have more than 2 IPSec VPN tunnels for dialup. But I don't have your FGT  config, so just a guess.  And you applied the filter in the IKE debug so I can't tell it.

[Toshi_Esumi]

At least I can tell what you captured in the IKE debug is NOT from a FortiClient VPN, but from a Cisco router or FW.
"ike 0:8e4bdbe27e046fb7/0000000000000000:16: VID CISCO-UNITY ...."

Toshi

[JoaquimdeSousa]

Hello @dingjerry_FTNT

Sorry for the delay.
Unfortunately, The VPN still shows INACTIVE.

Thanks for your help.
Kind Regards,
Jo

I send you hereby IKE debug commands Outputs and FGT config.

Reproductions following your advices
---------------------------------------------------

1) In IPSec Mode Config of phase1 settings, the subnet mask for the range is 255.255.255.255 according to the doc;
-> OK, I understand.
In fact, when I first set up the VPN using the Wizard, it automatically assigned the subnet mask 255.255.255.255.

2) You enabled Split Tunneling but applied "all" for the range. That makes no difference with Full tunneling.
-> OK, Sorry,
I just set "LAN" access, instead of "All".

3) The VPN interface, do not use "10.0.0.0", you may use 10.0.0.2 since you used 10.0.0.1 for remote peer. And apply subnet mask /32 for it.
-> OK, I just set it to 10.0.0.2/32

4) But I suggest you not use IPs from the same subnet for the dialup users as the VPN interface IPs.
-> Can you please tell me where to change this ???

5) If possible, could you please provide the FGT config?
-> Here it is : https://pastebin.com/VSAPiD2A

6) BTW, how many IPSec VPN tunnels are there? If more than 2, are they all for dialup?
-> I only created 1 IPSec VPN tunnel
-> But there is this "Fortilink Aggregate" : https://ibb.co/DRPc0jp

7) IKE debug commands Outputs
-> https://pastebin.com/CBnUiR8k

Kind Regards,
Jo

[dingjerry_FTNT]

Hi @JoaquimdeSousa ,

It seems that everything on FGT is correct.

I assume your client is Windows based.  

Could you please confirm whether you have Windows Firewall turned on or any third-party Anti-Virus software there?  If yes, please turn them off all.

[dingjerry_FTNT · Accepted solution]

And if possible, on your client, run WireShark to capture traffic on ports 500 or 4500.