Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ehsangha
New Contributor

IPSec Remote Access

Hi everyone.

I need to create two phase2  interfaces for IPSec Remote access to allow users to connect to two different subnets. I have created phase 1 and phase 2 interfaces, but the VPN connection failed.

 

config vpn ipsec phase1-interface
edit "IPsec_Clients"
set type dynamic
set interface "wan1"
set mode aggressive
set peertype any
set net-device enable
set mode-cfg enable
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set xauthtype auto
set authusrgrp "DC-VPN"
set ipv4-start-ip 172.16.17.129
set ipv4-end-ip 172.16.17.254
set ipv4-netmask 255.255.255.128
set dns-mode auto
set ipv4-split-include "IPsec_Clients_split"
set save-password enable
set psksecret ENC 2kvF93dFz+5UvJw0S50Bor9tCqr6vYz7pPR2fvGbrWd4W3cblxHIHxhyLTYFOYGM0l+bq65DpcnqU4ij5S3C0jKgglRrnnRbK1gLljGNYeR1C1OgVmJ3xuJMDxPBifR2FjFeZ8I8WzdaEuIg5Zx60CYvbuUCak80vyBcpzauEUyURIq56C7kguCO5AFJN/f4l8lffw==
next
end

config vpn ipsec phase2-interface
edit "IPsec_Clients"
set phase1name "IPsec_Clients"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set src-subnet 172.16.17.128 255.255.255.128
set dst-subnet 192.168.10.0 255.255.255.0
next
edit "IPsec_Clients1"
set phase1name "IPsec_Clients"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set src-subnet 172.16.17.128 255.255.255.128
set dst-subnet 192.168.9.0 255.255.255.0
next
end

 

12 REPLIES 12
OmarUrquijo
New Contributor II

Hi ehsangha can you share the error log ? 

ehsangha

Hi 

ike 0: comes xxx.xxx.xxx.179:500->xxx.xxx.xxx.72:500,ifindex=7,vrf=0....
ike 0: IKEv1 exchange=Informational id=ad8f4dccb37dd3ec/e48f5c1030aef594:8aeb74a3 len=108 vrf=0
ike 0: in AD8F4DCCB37DD3ECE48F5C1030AEF594081005018AEB74A30000006CA19885F79AC9B5BE4AB4542FBEDB61E6FC6B15D11B32DB93DE795E467D335CE47572FA0C6AA7FC7A8BD6792A20EAE410434162A89903B5EF4768F11AA2823E35A9C09F972A53E0CCADB341F93F6C6A52
ike 0: no established IKE SA for exchange-type Informational from xxx.xxx.xxx.179:500->xxx.xxx.xxx.72 7 cookie ad8f4dccb37dd3ec/e48f5c1030aef594, drop
ike shrank heap by 4096 bytes

AEK
SuperUser
SuperUser

Hello

Which one fails? phase1 or phase2?

If you have access to FortiGate then please run these commands on the FGT, try to connect to IPsec, then share the output.

diag debug app ike -1
diag vpn ike log-filter name IPsec_Clients
diag debug enable
AEK
AEK
ehsangha
New Contributor

Hi . phase 1 fails

ehsangha
New Contributor

ike 0: no established IKE SA for exchange-type Informational from xxx.xxx.xxx.179:500->xxx.xxx.xxx.72 7 cookie ad8f4dccb37dd3ec/e48f5c1030aef594, drop
ike shrank heap by 4096 bytes

nathan_h
Staff
Staff

Do you have an existing Dialup configured? Run the debug and see it is matching the correct Dialup tunnel. If it is possible you can share the IKE debug output.

Nathan
FCP-NS, FCP-PCS, FCP-SO, FCSS-NS, FCSS-PCS, FCSS-SASE
FortiArt
Staff
Staff

You can use the dialup wizard and enable split-tunneling and defined the two destination subnets using the wizard. This allow users to have access to both subnets. You can also create 2 firewall polices each has different destination if the source groups of users are different however you need to define the groups to match firewall polices on tunnel configuration NOT on the tunnel itself.

 

Hope this help

ehsangha
New Contributor

Hi 

ike 0: comes xxx.xxx.xxx.179:500->xxx.xxx.xxx.72:500,ifindex=7,vrf=0....
ike 0: IKEv1 exchange=Informational id=ad8f4dccb37dd3ec/e48f5c1030aef594:8aeb74a3 len=108 vrf=0
ike 0: in AD8F4DCCB37DD3ECE48F5C1030AEF594081005018AEB74A30000006CA19885F79AC9B5BE4AB4542FBEDB61E6FC6B15D11B32DB93DE795E467D335CE47572FA0C6AA7FC7A8BD6792A20EAE410434162A89903B5EF4768F11AA2823E35A9C09F972A53E0CCADB341F93F6C6A52
ike 0: no established IKE SA for exchange-type Informational from xxx.xxx.xxx.179:500->xxx.xxx.xxx.72 7 cookie ad8f4dccb37dd3ec/e48f5c1030aef594, drop
ike shrank heap by 4096 bytes

 

AEK

Hi

I don't think this is the right message you are looking for.

Try check phase1 config from both ends, make sure they match.

AEK
AEK
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors