IPSEC Tunnel doesn't match user in incoming traffic.

[fortimaster]

Hi all,

I have create an IPSEC dial up tunnel with Ike v2 and NAT-T. I use Forticlient to connect to it and it works well. 

I have observed that some traffic are denyed cause when I send traffic across the tunnel, the user with witch Im logged (using forticlient) is not associated with the incoming traffic. I can see the IP from the private tunnel network but not the username. That causes the incoming traffic matches a deny policy, cause I use an user group in the incoming rule that permits traffic from the IPSEC interface. For example, I can see traffic from 192.168.106.x but the incoming traffic has not an user associated.

Why the username with witch Im connected to the tunnel are not matched in incoming traffic?

I attach you the tunnel configuration:

Thanks ¡¡¡

[fortimaster]

Hi hbac. Ikev2 is recommended whenever possible. Could you confirm me that with this protocol I have that limitation? I am surprised cause I thought that Ikev1 is an evolution of ikev2.

[hbac · Accepted solution]

@fortimaster,

Yes, it is a limitation because "inherit from policy" doesn't exist when using IKEv2. You can submit a new feature request for it if you want. 

Regards, 

[fortimaster]

Thanks hbac. I will do different tunnels to solve that limitation. Thank you very much for your help ¡

[qx]

I came across this thread because I also wanted to use ikev2 but regulate user privilges by firewall policies. I found this post https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-multiple-groups-with-EAP-for-IK...

Which gives instructions on how to do it, so it is definitely possible by now!