How to get an IPsec VPN Tunnel with a Debian laptop?

[AliE]

Hi all,

We want to use IPsec VPN, and we have some Debian users. We have tried to use the package "strongswan" but we haven't  succeeded to connect it. We want to use verification with ldap to authenticate and accept it.

In our FortiGate we have this configuration:

For the 1st phase: 

 

For the 2nd phase:

 
In our Debian machine, we have tried this configuration:
In the ipsec.conf:

 

In the  IPSec.secrets:

 

In the updown.sh: 

Here, it's the test of our configuration:

 

Do you have any idea about it? 
Ali

[spoojary]

Does this doc help: https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-connection-between-FortiGate-and-Ubu...

[Debbie_FTNT]

Hey AliE,

one thing that confuses me a bit is the peertype/peerid setting on FortiGate; with that in place, FortiGate would only accept connections from a client that provides that particular peerid during the tunnel setup, and the snippets from your debian environment do not include anything like that ID, as far as I can see.

Maybe remove that, set peertype 'any', and try again?

Please note that peertype 'any' can cause conflict if you have other VPNs listening on the same interface, in that case, do NOT try this!

Cheers,

Debbie

[AliE]

Hi,

Thank you for your response. I have rewrite the file "ipsec.conf" and now it's working! 

conn hq
        keyexchange = ikev1
        ike = aes256-sha256-modp3072
        #esp = aes256-sha256-modp3072

        esp = aes256-sha256


        aggressive = yes

        right = 85.158.*.*
        rightsubnet = 10.*.5.0/24
        rightauth = psk

        left = %defaultroute
        leftsourceip=%config
        leftauth = psk
        leftauth2 = xauth
        xauth_identity = test.vpn

        auto = add
        leftupdown = /usr/lib/ipsec/updown.sh

But now I have another problem...

When I'm connected, the different routes don't propagate but in windows with fortclient, I can receive these routes. I have enabled ipv4 split tunnel and create a book of addresses for "accesible networks".

Do you have an idea?

Ali

[sw2090]

afair strongswan/openswan do not support split tunneling in ike v1. You might have to either switch your ipsec to ike v2 or set your routes manually.