IPSEC VPN connection error

[INT1]

Hello, i have an error with connecting to IPSEC vpn IKEV2 using Azure AD email whats happening is after i get the pop up to enter the credenials after i enter and get the 2FA popup it says VPN connection is down and when i check the logs i get this error:

 

i tried turning off the firewall on the device im trying to connect from, i restarted the services, removed and redownloaded the vpn and still nothing is changing 

[AEK]

Hi INT1

Try run this on FG.

diagnose debug console timestamp enable

diagnose debug app ike -1

diagnose debug app fnbamd -1

diagnose debug

[INT1]

to give abit mroe details there is no misconfiguration in the VPN IPSEC or anything related in the firewall but im having some issues with some users each different but this i couldn't find a solution to

[Jz_FTNT]

you said some users having issues. Are those users using WiFi ? Does it make a difference if they switch to ethernet connection ?

[INT1]

we havent tried on ethernet connection cause i think they dont have a cable, but we tried on hotspot an still issue

[INT1]

2024-10-18 14:09:40.287677 ike V=root:0:VPN-NAME:463: notify msg received: R-U-THERE-ACK
2024-10-18 14:11:33.699800 ike V=root:0:VPN-NAME: HA IPsec send ESP seqno=347e, num=2
2024-10-18 14:13:03 [2440] handle_req-Rcvd auth cache message
2024-10-18 14:13:03 [139] __saml_auth_cache_push-Hash bucket 99
2024-10-18 14:13:03 [186] __saml_auth_cache_push-New auth cache entry is created, user='SAML-ID', saml_user='username@company.com', expires=1729253583, SAML_server='ssl-azure-saml', vfid=0
2024-10-18 14:15:15 [2440] handle_req-Rcvd auth cache message
2024-10-18 14:15:15 [139] __saml_auth_cache_push-Hash bucket 99
2024-10-18 14:15:15 [145] __saml_auth_cache_push-Update 'SAML-ID', SAML_server='ssl-azure-saml', vfid=0
2024-10-18 14:15:19.278315 ike V=root:0: comes Remote-IP-1:500->Local-IP:500,ifindex=5,vrf=0,len=536....
2024-10-18 14:15:19.278441 ike V=root:0: IKEv2 exchange=SA_INIT id=IKE-ID/0000000000000000 len=536
2024-10-18 14:15:19.278491 ike 0: in IKE-ID...
2024-10-18 14:15:19.278618 ike V=root:0:IKE-ID:465: responder received SA_INIT msg
2024-10-18 14:15:19.278669 ike V=root:0:IKE-ID:465: VID forticlient connect license License-ID
2024-10-18 14:15:19.278717 ike V=root:0:IKE-ID:465: VID Fortinet Endpoint Control Control-ID
2024-10-18 14:15:19.278764 ike V=root:0:IKE-ID:465: VID Forticlient EAP Extension Extension-ID
2024-10-18 14:15:19.278812 ike V=root:0:IKE-ID:465: received notify type NAT_DETECTION_SOURCE_IP
2024-10-18 14:15:19.278859 ike V=root:0:IKE-ID:465: received notify type NAT_DETECTION_DESTINATION_IP
2024-10-18 14:15:19.278917 ike V=root:0:IKE-ID:465: incoming proposal:
2024-10-18 14:15:19.279030 ike V=root:0:IKE-ID:465: protocol = IKEv2...
2024-10-18 14:15:19.282515 ike V=root:0:IKE-ID:465: SA proposal chosen, matched gateway VPN-GATEWAY-ID
2024-10-18 14:15:19.282664 ike V=root:0:VPN-GATEWAY-ID: created connection: 0x974f9c0 5 Local-IP->Remote-IP-1:500.
2024-10-18 14:15:19.284275 ike V=root:0:VPN-GATEWAY-ID:465: generate DH public value request queued
2024-10-18 14:15:19.287639 ike V=root:0:VPN-GATEWAY-ID:465: sent IKE msg (SA_INIT_RESPONSE): Local-IP:500->Remote-IP-1:500, len=416, vrf=0, id=IKE-ID, oif=5
2024-10-18 14:16:33.719820 ike V=root:0:VPN-NAME: HA IPsec send ESP seqno=347e, num=2
2024-10-18 14:17:20.291556 ike V=root:0: comes Remote-IP-2:500->Local-IP:500,ifindex=5,vrf=0,len=108....
2024-10-18 14:17:20.291664 ike V=root:0: IKEv1 exchange=Informational id=IKE-ID:da40adc2 len=108 vrf=0
2024-10-18 14:17:20.292236 ike V=root:0:VPN-NAME:463: sent IKE msg (R-U-THERE-ACK): Local-IP:500->Remote-IP-2:500, len=108, vrf=0, id=IKE-ID
2024-10-18 14:18:39.279786 ike V=root:0:VPN-NAME:465: negotiation timeout, deleting
2024-10-18 14:18:39.279981 ike V=root:0:VPN-NAME: connection expiring due to phase1 down

[INT1]

This is the diagnose im getting after trying to connect i dont really see anything 

[tpatel]

Hello Int1,

In Ike debug fortigate is responding packet 14:15:19 send ike message and after that not getting any response, and connection get timeout.

Make sure you set dpd on idle in ipsec configuration. 

https://community.fortinet.com/t5/FortiClient/Technical-Tip-Configuring-DPD-dead-peer-detection-on-I...

Can you please try to connect using different ISP for test.

[INT1]

hello, yeah i tried doing that i set it on idle but still im getting the same thing

[AEK]

So in summary, client says phase1 retransmit reaches maximum count, and server doesn' receive from client and says negotiation timeout.

In addition to Patel's suggestion (try using other ISP), you may also try using a stable FCT version, like 7.2.5 or 7.0.13.

Also you said the issue happens to some users. Is there any common thing between these users? Like they have Windows 11? Or a specific NIC driver? Or they are stored on other authentication server? Or anything else?