IPSec VPN for iOS-issue

[Fjordmonkey]

Greetings!

I've recently come across a strange issue with two different Fortigate-boxes, both running 5.2.2. On both of these, I am unable to connect the built-in client on iOS to the iOS Wizard-created IPSec VPN's. On a third box, also running 5.2.2, there is no issue at all even though all three boxes has their iOS-VPNs set up through the wizard and thus exactly the same way (Even checked and followed the tech-article and video for setting this up, as I'm a bit of a noob).

The only major difference is that the two Fortigates that will not accept connections to the iOS-tunnel already has IPSec VPN's on them. One box has a Site-to-Site tunnel on it, the other has a Forticlient-dialup tunnel. Both also has SSL-VPN's for FortiClient.

Tried to google this as much as possible but has been unable to find a solution or even someone that has the same type of issue. Thus I turn to you :)

Anyone able to shed some light on the issue or point me in the correct direction?

[jtfinley · Accepted solution]

Well, I can testify @Fjordmonkey is correct in his/her findings.  I have (2) Fortigate 90D.  One was upgraded to 5.2.3, the other  format flash, tftp 5.2.3.  The upgraded IOS VPN will not work, the flash from scratch does.  Anyone else see why this is an issue?

[emnoc]

You can start by comparing the tunnel cfg used by the non-working with the working unit. You can dump the config file and go down to the section of  config vpn ipsec phase1

FWIW; the wizard is not a 100% tool for vpn creation but more of a get you started type. You might have to tweak and adjust based on what your running.

[Fjordmonkey]

I went through and checked both Phase1 and Phase2-settings between all three boxes, and they are identical except the differences in IP-adresses involved. Did a config-dump and printout of both Phase1 and Phase2-settings from the configs and compared, as well as doing a Get on both interfaces on all three boxes. No differences, again, apart from IP-adresses involved.

Going to nuke one of the IPSec tunnels in place on one of the boxes and then try to create the iOS-tunnel before creating the Site-to-Site-tunnel tonight, and see if that works. Probably a longshot, but worth a try at this point.

Very strange issue, this.

[Fjordmonkey]

Update on the issue:

Tried nuking the IPSec-settings on the firewall in question, and then ONLY set up IPsec for iPhone through the wizard on board. No-go, same error.

Then tried to set up the settings manually in the tunnel-setup on the FGT: No-go, same error.

Had an old FortiWifi 40C that I upgraded to 5.2.3 and tried that at home. On THAT box it worked perfectly.

Not really sure what to do, but right now taking the FGT60D that's having issues to 5.2.3 is an alternative. I really don't want to wipe the entire config off it and rebuild after the upgrade, but it IS an option.

[rwpatterson]

OK. Try shooting at this from a different angle. What models are these boxes? (working and not working)

[Fjordmonkey]

FortiWifi 40C running at home, running 5.2.2: Works like a boss.

FortiWifi 40C at a co-workers house, running 5.2.3: Works like a boss

Fortigate 80C, running 5.2.0 build 589: Not working

Fortigate 60D, Running 5.2.2 build 642: Not working

The main difference apart from the models is that both the 80C and the 60D already has IPSec-tunnels on them. The 80C has a dialup-profile for use with FortiClient IPSec, and the 60D has a Site-to-Site IPSec on it.

Thanks for your continued help and input :)

[Fjordmonkey]

Well, further update.

Handed in a support-ticket to Fortigate, and had a tech in to view the config and test things. He managed to get the connection up and running through converting the tunnel to a Custom tunnel, and turning off NAT-traversal. But as I found out today when I tested things: No traffic will go through, regardless of what the IPV4-policies say and do. Set up the exact same tunnel on the FortiWifi40C I have at home with the same result. Turned NAT-traversal on in the tunnel conf'ed on the 40C: VPN Connects AND lets traffic through to the other side. Tried setting up both a Wizard-tunnel and a custom tunnel on the 40C at home: Both work flawlessly.

I seriously don't understand this at all.

[emnoc]

What do you mean by "custom" ? But  either way you should be using the diag debug flow on these non working units. pick a host behind the firewall and place that in your diag debug flow filter , run a ping or start any traffic that matches your policy and display the output.

If it's a route-based vpn ( please say it is  ) than you need to ensure 1st that you have a route. if you do, than the next course would be to check the fwpolicy and the phase2 proxy-ids for this traffic to be encrypted.

Ken

[Fjordmonkey]

Well, lost patience today, and formatted the bootdrive on the 60D in question. Re-flashed it with 5.0.11, restored the config, recreated the iOS-VPN-tunnel and tested it. Worked like a charm.

Just out of academic interest, I took the backup I made this morning before I formatted it, went through the whole process again but this time flashed in 5.2.3 and restored. ALSO worked like a charm.

I think the moral of the story is this: The next time I have weird and somewhat unexplainable issues with a Fortigate-unit, I'll just wipe it and restore.

Thanks for all hints, tips and pointers, guys! Highly appreciated.

[jtfinley]

Im having the exact same problem.  Did the wizard per link below verbatim and on two IOS devices.  Both units say "The VPN server did not respond."

Output: 

ike 0: IKEv1 Aggressive, comes 111.111.47:10325->222.222.43.138 6, peer-id=IOS_VPN ike 0:bc0f558d7f6f53dd/0000000000000000:48: incoming proposal: ike 0:bc0f558d7f6f53dd/0000000000000000:48: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:48: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:48: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:48: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_HASH_ALG, val=SHA. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:48: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:48: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:48: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:48: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:48: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_HASH_ALG, val=SHA. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:48: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:48: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:48: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:48: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:48: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_HASH_ALG, val=MD5. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:48: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:48: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:48: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:48: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:48: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_HASH_ALG, val=MD5. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:48: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:48: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:48: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:48: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:48: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_ENCRYPT_ALG, val=3DES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_HASH_ALG, val=SHA. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:48: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:48: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:48: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:48: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:48: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_ENCRYPT_ALG, val=3DES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_HASH_ALG, val=MD5. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:48: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:48: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:48: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:48: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:48: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_ENCRYPT_ALG, val=DES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_HASH_ALG, val=SHA. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:48: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:48: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:48: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:48: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:48: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_ENCRYPT_ALG, val=DES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_HASH_ALG, val=MD5. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:48: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:48: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:48: negotiation failure ike Negotiate ISAKMP SA Error: ike 0:bc0f558d7f6f53dd/0000000000000000:48: no SA proposal chosen 5A4A0B7E05B2FBB059144F866B23C53C08100501BC09C7750000005C36011955E97C3261F40C06A0D2F3ike 0: comes 111.111.141.47:10325->222.222.43.138:500,ifindex=6....

ike 0: IKEv1 exchange=Aggressive id=bc0f558d7f6f53dd/0000000000000000 len=763 i ike 0:bc0f558d7f6f53dd/0000000000000000:49: VID draft-ietf-ipsec-nat-t-ike-06 4D1E0E136DEAFA34C4F3EA9F02EC7285 ike 0:bc0f558d7f6f53dd/0000000000000000:49: VID draft-ietf-ipsec-nat-t-ike-05 80D0BB3DEF54565EE84645D4C85CE3EE ike 0:bc0f558d7f6f53dd/0000000000000000:49: VID draft-ietf-ipsec-nat-t-ike-04 9909B64EED937C6573DE52ACE952FA6B ike 0:bc0f558d7f6f53dd/0000000000000000:49: VID draft-ietf-ipsec-nat-t-ike-03 7D9419A65310CA6F2C179D9215529D56 ike 0:bc0f558d7f6f53dd/0000000000000000:49: VID draft-ietf-ipsec-nat-t-ike-02 CD60464335DF21F87CFDB2FC68B6A448 ike 0:bc0f558d7f6f53dd/0000000000000000:49: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F ike 0:bc0f558d7f6f53dd/0000000000000000:49: VID draft-ietf-ipsra-isakmp-xauth-06.txt 09002689DFD6B712 ike 0:bc0f558d7f6f53dd/0000000000000000:49: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100 ike 0:bc0f558d7f6f53dd/0000000000000000:49: VID DPD AFCAD71368A1F1C96B8696FC77570100 ike 0: IKEv1 Aggressive, comes 111.111.141.47:10325->222.222.43.138 6, peer-id=IOS_VPN ike 0:bc0f558d7f6f53dd/0000000000000000:49: incoming proposal: ike 0:bc0f558d7f6f53dd/0000000000000000:49: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:49: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:49: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:49: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_HASH_ALG, val=SHA. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:49: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:49: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:49: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:49: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:49: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_HASH_ALG, val=SHA. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:49: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:49: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:49: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:49: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:49: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_HASH_ALG, val=MD5. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:49: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:49: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:49: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:49: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:49: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_HASH_ALG, val=MD5. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:49: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:49: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:49: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:49: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:49: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_ENCRYPT_ALG, val=3DES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_HASH_ALG, val=SHA. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:49: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:49: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:49: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:49: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:49: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_ENCRYPT_ALG, val=3DES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_HASH_ALG, val=MD5. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:49: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:49: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:49: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:49: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:49: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_ENCRYPT_ALG, val=DES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_HASH_ALG, val=SHA. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:49: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:49: proposal id = 0: ike 0:bc0f558d7f6f53dd/0000000000000000:49: protocol id = ISAKMP: ike 0:bc0f558d7f6f53dd/0000000000000000:49: trans_id = KEY_IKE. ike 0:bc0f558d7f6f53dd/0000000000000000:49: encapsulation = IKE/none ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_ENCRYPT_ALG, val=DES_CBC. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_HASH_ALG, val=MD5. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:bc0f558d7f6f53dd/0000000000000000:49: type=OAKLEY_GROUP, val=MODP1024. ike 0:bc0f558d7f6f53dd/0000000000000000:49: ISAKMP SA lifetime=3600 ike 0:bc0f558d7f6f53dd/0000000000000000:49: negotiation failure ike Negotiate ISAKMP SA Error: ike 0:bc0f558d7f6f53dd/0000000000000000:49: no SA proposal chosen

http://video.fortinet.com/video/103/ipsec-vpn-for-remote-ios-users-5-2

I'm really not liking the constant changing in FortiOS.