IPsec Client VPN IKEv2 Split-Tunneling

[MarioBerger]

Dear Community, 

due to the fact that Fortinet decided to remove the Classic SSL-VPN with 7.6. the first people try to migrate from SSL-VPN to Dial-Up IPsec with mode-config.
To test it for a customer i built following lab:

I was able to get it all running on IKEv2, but somehow eventhough i enabled Split-Tunneling for both ipv4 and ipv6 
i receive a default route for both v4 and v6.

Does anyone know the issue and know how to solve it?

Thanks
Mario :)

[funkylicious]

hi,

what did you specify/referenced in the split-tunnel options ? is the object in question a network object containing a network /mask or is it a range of addresses/ips ?

[MarioBerger]

Hi,

The split-tunnel option i mentioned is "ipv4-split-include" same for v6.
The Objects are  "lo1 address" - 172.16.1.0/24 and "lo1_net" - fd00:affe:1::/64 .

--------------------
config vpn ipsec phase1-interface
edit "ReAc_test1"
set type dynamic
set interface "wan1"
set ike-version 2
set peertype any
set net-device disable
set mode-cfg enable
set proposal aes256-sha512
set dhgrp 21
set eap enable
set eap-identity send-request
set authusrgrp "group1"
set ipv4-start-ip 172.31.251.2
set ipv4-end-ip 172.31.251.254
set ipv4-split-include "lo1 address"
set ipv6-start-ip fd00:affe:1::2
set ipv6-end-ip fd00:affe:1::ffff
set ipv6-prefix 64
set ipv6-split-include "lo1_net"
set save-password enable
set client-auto-negotiate enable
set client-keep-alive enable
set psksecret ENC XXX
next
--------------------------------
Phase 2:
config vpn ipsec phase2-interface
edit "ReAc_test1"
set phase1name "ReAc_test1"
set proposal aes256-sha512
set dhgrp 21
set keepalive enable
set comments "VPN: ReAc_test1 (Created by VPN wizard)"
set src-addr-type name
set dst-addr-type name
set src-name "lo1 address"
set dst-name "all"
next

edit "ReAc_test1v6"
set phase1name "ReAc_test1"
set proposal aes256-sha512
set dhgrp 21
set keepalive enable
set src-addr-type name6
set dst-addr-type name6
set src-name6 "all"
set dst-name6 "all"
next
-------------------------------------------

What i'm also unable to do is to use multible Phase1 Interfaces to connect different Usergroups.

No matter what, when i try to connect with user test2 the connection is only triggered on ReAc_test1

ike V=root:0:ReAc_test1:1: responder received EAP msg
ike V=root:0:ReAc_test1:1: send EAP message to FNBAM
ike V=root:0:ReAc_test1:1: initiating EAP authentication
ike V=root:0:ReAc_test1: EAP user "test2"
ike V=root:0:ReAc_test1: auth group group1
ike V=root:0:ReAc_test1: EAP 876280606722 pending
ike V=root:0:ReAc_test1:1 EAP 876280606722 result FNBAM_ERROR
ike V=root:0:ReAc_test1: EAP failed for user "test2"
ike V=root:0:ReAc_test1: EAP response is empty
ike V=root:0:ReAc_test1: connection expiring due to EAP failure
ike V=root:0:ReAc_test1: going to be deleted

Thanks
Mario :)

[Xronos]

Hi Marco,

I think you should first explain why you want to use different Phase 1 configurations.

You can assign different access permissions using firewall rules based on user groups. With RADIUS (e.g. connected to Active Directory), that also works directly.
Don't forget to completely remove the authusrgrp setting in Phase 1 (i.e. use unset authusrgrp).

Otherwise, if you really need different Phase 1 configurations, the FortiGate can't easily distinguish them.
For that, you can use the network-id. Just keep in mind that the network-id also needs to be configured on the client side.

config vpn ipsec phase1-interface

edit <example>

set ike-version 2

set network-overlay

enable set network-id <integer>

next

end

[MarioBerger]

Hi,

thanks for the explaination with the authusrgrp i tested it and permitting the IPsec connection based on Policy works fine.

Still having troubles with ipv4 split tunneling not working.
Eventhough  set ipv4-split-include "lo1 address"  is active (i also tested it with custom non auto-created objects and object groups)


route print without IPsec connection

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0             XXXX            XXXX      45
         10.1.0.0    255.255.255.0         On-link          10.1.0.2    281
         10.1.0.2  255.255.255.255         On-link          10.1.0.2    281
       10.1.0.255  255.255.255.255         On-link          10.1.0.2    281
             XXXX    255.255.255.0         On-link              XXXX    301
             XXXX   255.255.255.255        On-link              XXXX    301
             XXXX   255.255.255.255        On-link              XXXX    301
    100.100.100.0    255.255.255.0       10.1.0.254         10.1.0.2     26
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link              XXXX    301
        224.0.0.0        240.0.0.0         On-link          10.1.0.2    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link              XXXX    301
  255.255.255.255  255.255.255.255         On-link          10.1.0.2    281
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 11    281 ::/0                     fe80::ae71:2eff:fe78:dbf1
  1    331 ::1/128                  On-link
 11    281 fd00:1::a01:1/128        On-link
 11    281 fe80::/64                On-link
 11    281 fe80::d4e1:952a:8dae:894/128
                                    On-link
  1    331 ff00::/8                 On-link
 11    281 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

Routing Table with IPsec connection active

IPv4 Route Table

===========================================================================

Active Routes:

Network Destination        Netmask          Gateway       Interface  Metric

          0.0.0.0          0.0.0.0     172.31.251.3     172.31.251.2     25

          0.0.0.0          0.0.0.0             XXXX            XXXX      45

         10.1.0.0    255.255.255.0         On-link          10.1.0.2    281

         10.1.0.2  255.255.255.255         On-link          10.1.0.2    281

       10.1.0.255  255.255.255.255         On-link          10.1.0.2    281

             XXXX    255.255.255.0         On-link              XXXX    301

             XXXX   255.255.255.255         On-link             XXXX    301

             XXXX   255.255.255.255         On-link             XXXX    301

             XXXX   255.255.255.255         On-link             XXXX    301

    100.100.100.0    255.255.255.0       10.1.0.254         10.1.0.2     26

    100.100.100.2  255.255.255.255       10.1.0.254         10.1.0.2     25

        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331

        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331

  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331

     172.31.251.2  255.255.255.255         On-link      172.31.251.2    281

        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331

        224.0.0.0        240.0.0.0         On-link      172.31.251.2    281

        224.0.0.0        240.0.0.0         On-link       10.2.200.38    301

        224.0.0.0        240.0.0.0         On-link          10.1.0.2    281

  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331

  255.255.255.255  255.255.255.255         On-link      172.31.251.2    281

  255.255.255.255  255.255.255.255         On-link       10.2.200.38    301

  255.255.255.255  255.255.255.255         On-link          10.1.0.2    281

===========================================================================

Persistent Routes:

  None

IPv6 Route Table

===========================================================================

Active Routes:

 If Metric Network Destination      Gateway

 11    281 ::/0                     fe80::ae71:2eff:fe78:dbf1

  1    331 ::1/128                  On-link

 11    281 fd00:1::a01:1/128        On-link

 28     50 fd00:affe:1::/64         On-link

 28    281 fd00:affe:1::2/128       On-link

 28     50 fd00:affe:2::/64         On-link

 28    281 fe80::/64                On-link

 11    281 fe80::/64                On-link

 28    281 fe80::5986:9d3f:46db:744/128

                                    On-link

 11    281 fe80::d4e1:952a:8dae:894/128

                                    On-link

  1    331 ff00::/8                 On-link

 28    281 ff00::/8                 On-link

 11    281 ff00::/8                 On-link

===========================================================================

Persistent Routes:

  None

 

Thanks
Mario

[Xronos]

Start with a minimal setup. It’s best to delete both phase 1 and phase 2 completely and create them from scratch:

config vpn ipsec phase1-interface
edit "ReAc_test1"
set type dynamic
set interface "wan1"
set ike-version 2
set peertype any
set net-device disable
set mode-cfg enable
set proposal aes256-sha512
set dhgrp 21
set eap enable
set eap-identity send-request
set nattraversal forced
set ipv4-start-ip 172.31.251.2
set ipv4-end-ip 172.31.251.254
set ipv4-split-include "lo1 address"
set save-password enable
set client-auto-negotiate enable
set client-keep-alive enable
set psksecret ENC XXX
next

config vpn ipsec phase2-interface
edit "ReAc_test1"
set phase1name "ReAc_test1"
set proposal aes256-sha512
set dhgrp 21
set keepalive enable
next

For IPv6:
Make sure that IPv6 is also enabled in FortiClient:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Not-receiving-an-IPv6-address-from-Dialup-...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-Dialup-IPsec-remote-acces...

[MarioBerger]

Thanks for the reply.

Since i'm currently out of office and can't test my lab i have to test it.
On a Fortinet xperts i got a hint that it maybe were caused by a bug in forticlient.

Seems like upgrading Forticlient from 7.2.x to 7.4.x such behavior can occur.
A fresh install should fix it.

I will test both on monday when i'm back in office and can access my lab.

Thanks
Mario

[kmohan]

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Not-receiving-an-IPv6-address-from-Dialup-...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-Dialup-IPsec-remote-acces...

[Xronos]

Thanks for posting exactly the same URLs as I did :p