IP sec remote access vpn not working in Azure

[Krutibasa25]

Hi Team,

I deployed two FortiGate firewalls in HA (Active-Passive) ELB/ILB through Azure Marketplace. Configured IPSec remote access VPN using the wizard, created user, policy, and allowed ports 500/4500 in the external load balancer.

VPN is not connecting. Please help if any additional config is needed, or share any working reference link.

Thanks,

Krutibasa

[AEK]

Hi Krutibasa

First thing is tocheck if your FortiGate is receiving IKE packets from remote host.

diag sniffer packet any "host x.x.x.x" 4

Where x.x.x.x is IP of the remote host.

[Krutibasa25]

Hi @AEK Yes ,i verified .it was sending only 443 packet .

diag sniffer packet any "host x.x.x.x" 4
Using Original Sniffing Mode
interfaces=[any]
filters=[host x.x.x.x]
0.674190 sriovslv0 in x.x.x.x.19005 -> 10.0.5.148.443: psh 3671408487 ack 1247273597
0.674192 port4 in x.x.x.x.19005 -> 10.0.5.148.443: psh 3671408487 ack 1247273597
0.681189 port4 out 10.0.5.148.443 -> x.x.x.x.19005: 1247273597 ack 3671408592
0.681195 sriovslv0 out 10.0.5.148.443 -> x.x.x.x.19005: 1247273597 ack 3671408592
0.681207 port4 out 10.0.5.148.443 -> x.x.x.x.19005: psh 1247275045 ack 3671408592
0.681209 sriovslv0 out 10.0.5.148.443 -> x.x.x.x.19005: psh 1247275045 ack 3671408592
0.681374 port4 out 10.0.5.148.443 -> x.x.x.x.19005: psh 1247275189 ack 3671408592
0.681377 sriovslv0 out 10.0.5.148.443 -> x.x.x.x.19005: psh 1247275189 ack 3671408592
0.825553 sriovslv0 in x.x.x.x.19005 -> 10.0.5.148.443: ack 1247275189
0.825555 port4 in x.x.x.x.19005 -> 10.0.5.148.443: ack 1247275189
0.908952 sriovslv0 in x.x.x.x.19005 -> 10.0.5.148.443: ack 1247275220
0.908954 port4 in x.x.x.x.19005 -> 10.0.5.148.443: ack 1247275220
1.671212 sriovslv0 in x.x.x.x.19005 -> 10.0.5.148.443: psh 3671408592 ack 1247275220
1.671215 port4 in x.x.x.x.19005 -> 10.0.5.148.443: psh 3671408592 ack 1247275220
1.678137 port4 out 10.0.5.148.443 -> x.x.x.x.19005: 1247275220 ack 3671408697
1.678144 sriovslv0 out 10.0.5.148.443 -> x.x.x.x.19005: 1247275220 ack 3671408697
1.678155 port4 out 10.0.5.148.443 -> x.x.x.x.19005: psh 1247276668 ack 3671408697
1.678157 sriovslv0 out 10.0.5.148.443 -> x.x.x.x.19005: psh 1247276668 ack 3671408697
1.678380 port4 out 10.0.5.148.443 -> x.x.x.x.19005: psh 1247276814 ack 3671408697
1.678383 sriovslv0 out 10.0.5.148.443 -> x.x.x.x.19005: psh 1247276814 ack 3671408697
1.781935 sriovslv0 in x.x.x.x.26673 -> 10.0.5.148.443: ack 3465176224
1.781938 port4 in x.x.x.x.26673 -> 10.0.5.148.443: ack 3465176224
1.781981 port4 out 10.0.5.148.443 -> x.x.x.x.26673: ack 2879305024
1.781984 sriovslv0 out 10.0.5.148.443 -> x.x.x.x.26673: ack 2879305024

after filter with this command i can see only 500 udp packet not 4500 packet .

diagnose sniffer packet any 'port 500 or port 4500' 4 0 a

diagnose sniffer packet any 'port 500 or port 4500' 4 0 a
Using Original Sniffing Mode
interfaces=[any]
filters=[port 500 or port 4500]
2025-06-26 12:06:45.226603 port1 in x.x.x.x -> 10.0.5.4.500: udp 412
2025-06-26 12:06:47.512894 sriovslv2 in x.x.x.x -> 10.0.5.4.500: udp 412
2025-06-26 12:06:47.512897 port1 in x.x.x.x -> 10.0.5.4.500: udp 412
2025-06-26 12:06:50.541776 sriovslv2 in x.x.x.x -> 10.0.5.4.500: udp 412
2025-06-26 12:06:50.541778 port1 in x.x.x.x -> 10.0.5.4.500: udp 412
2025-06-26 12:06:53.558044 sriovslv2 in x.x.x.x -> 10.0.5.4.500: udp 412
2025-06-26 12:06:53.558047 port1 in x.x.x.x -> 10.0.5.4.500: udp 412
^C
7 packets received by filter