IPSec Remote Access

[ehsangha]

Hi everyone.

I need to create two phase2  interfaces for IPSec Remote access to allow users to connect to two different subnets. I have created phase 1 and phase 2 interfaces, but the VPN connection failed.

config vpn ipsec phase1-interface
edit "IPsec_Clients"
set type dynamic
set interface "wan1"
set mode aggressive
set peertype any
set net-device enable
set mode-cfg enable
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set xauthtype auto
set authusrgrp "DC-VPN"
set ipv4-start-ip 172.16.17.129
set ipv4-end-ip 172.16.17.254
set ipv4-netmask 255.255.255.128
set dns-mode auto
set ipv4-split-include "IPsec_Clients_split"
set save-password enable
set psksecret ENC 2kvF93dFz+5UvJw0S50Bor9tCqr6vYz7pPR2fvGbrWd4W3cblxHIHxhyLTYFOYGM0l+bq65DpcnqU4ij5S3C0jKgglRrnnRbK1gLljGNYeR1C1OgVmJ3xuJMDxPBifR2FjFeZ8I8WzdaEuIg5Zx60CYvbuUCak80vyBcpzauEUyURIq56C7kguCO5AFJN/f4l8lffw==
next
end

config vpn ipsec phase2-interface
edit "IPsec_Clients"
set phase1name "IPsec_Clients"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set src-subnet 172.16.17.128 255.255.255.128
set dst-subnet 192.168.10.0 255.255.255.0
next
edit "IPsec_Clients1"
set phase1name "IPsec_Clients"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set src-subnet 172.16.17.128 255.255.255.128
set dst-subnet 192.168.9.0 255.255.255.0
next
end

[OmarUrquijo]

Hi ehsangha can you share the error log ? 

[ehsangha]

Hi 

ike 0: comes xxx.xxx.xxx.179:500->xxx.xxx.xxx.72:500,ifindex=7,vrf=0....
ike 0: IKEv1 exchange=Informational id=ad8f4dccb37dd3ec/e48f5c1030aef594:8aeb74a3 len=108 vrf=0
ike 0: in AD8F4DCCB37DD3ECE48F5C1030AEF594081005018AEB74A30000006CA19885F79AC9B5BE4AB4542FBEDB61E6FC6B15D11B32DB93DE795E467D335CE47572FA0C6AA7FC7A8BD6792A20EAE410434162A89903B5EF4768F11AA2823E35A9C09F972A53E0CCADB341F93F6C6A52
ike 0: no established IKE SA for exchange-type Informational from xxx.xxx.xxx.179:500->xxx.xxx.xxx.72 7 cookie ad8f4dccb37dd3ec/e48f5c1030aef594, drop
ike shrank heap by 4096 bytes

[AEK]

Hello

Which one fails? phase1 or phase2?

If you have access to FortiGate then please run these commands on the FGT, try to connect to IPsec, then share the output.

diag debug app ike -1
diag vpn ike log-filter name IPsec_Clients
diag debug enable

[ehsangha]

Hi . phase 1 fails

[ehsangha]

ike 0: no established IKE SA for exchange-type Informational from xxx.xxx.xxx.179:500->xxx.xxx.xxx.72 7 cookie ad8f4dccb37dd3ec/e48f5c1030aef594, drop
ike shrank heap by 4096 bytes

[nathan_h]

Do you have an existing Dialup configured? Run the debug and see it is matching the correct Dialup tunnel. If it is possible you can share the IKE debug output.

[FortiArt]

You can use the dialup wizard and enable split-tunneling and defined the two destination subnets using the wizard. This allow users to have access to both subnets. You can also create 2 firewall polices each has different destination if the source groups of users are different however you need to define the groups to match firewall polices on tunnel configuration NOT on the tunnel itself.

Hope this help

[ehsangha]

Hi 

ike 0: comes xxx.xxx.xxx.179:500->xxx.xxx.xxx.72:500,ifindex=7,vrf=0....
ike 0: IKEv1 exchange=Informational id=ad8f4dccb37dd3ec/e48f5c1030aef594:8aeb74a3 len=108 vrf=0
ike 0: in AD8F4DCCB37DD3ECE48F5C1030AEF594081005018AEB74A30000006CA19885F79AC9B5BE4AB4542FBEDB61E6FC6B15D11B32DB93DE795E467D335CE47572FA0C6AA7FC7A8BD6792A20EAE410434162A89903B5EF4768F11AA2823E35A9C09F972A53E0CCADB341F93F6C6A52
ike 0: no established IKE SA for exchange-type Informational from xxx.xxx.xxx.179:500->xxx.xxx.xxx.72 7 cookie ad8f4dccb37dd3ec/e48f5c1030aef594, drop
ike shrank heap by 4096 bytes

[AEK]

Hi

I don't think this is the right message you are looking for.

Try check phase1 config from both ends, make sure they match.