IPsec vpn guidance needed

[x_member]

Hi, 

Fortigate 60D v5.2.2, build 642 (GA)

I'm playing with a Fortigate 60D trying to learn about its features prior to installation, focusing primarily on VPNs at the moment. I have no previous experience with Fortinet products and do not configure VPNs very often (programmer by trade).

I'm facing some confusion at the moment whilst trying to setup native IPsec VPNs for Android and iOS clients.

I've been able to setup an Android VPN successfully, however if I add an iOS VPN (using the supplied tunnel templates) this immediately breaks the Android VPN with debug message: peer has not completed XAUTH exchange. Presumably this relates to the 'UserGroup' in

Removing the wizard's firewall rules and the tunnel created for the iOS VPN immediately resolves the problem and I'm then able to connect to the Android VPN again.

How does the Fortigate determine which VPN settings should be used to authenticate a remote client? 

Is what I'm trying to do possible to achieve? Am I failing to do something obvious?

Any pointers would be gratefully appreciated.

[emnoc]

See the  post/above or blow this one for  multiple VPN, but to answer the question. The peerid is what you use to determine the group.

You can assign only ONE peerid per vpn, but you can have numerous "peerid" and authgroups for the remote clients.

FWIW, I don't know why you would want to have a  android and iOS only vpn, my vpn works flawlessly and support all mobileOS btw.

And a hint; if you don't get xuath challenged, than 9 out of 10 times it's due to the  peerid being wrong. Shrewsoft vpn is great for testing this and is a very advance configuration. So you can test it using shrewsoft vpn client and then adjust according to your mobile devices and usergroups.

[link]https://www.shrew.net/download/vpn[/link]

[x_member]

Thanks for responding so quickly.

emnoc wrote:

FWIW, I don't know why you would want to have a  android and iOS only vpn, my vpn works flawlessly and support all mobileOS btw.

Quite honestly I don't - however I've yet to find any documentation / posts online that offer a guide to configuring a single vpn for both android and iOS native.

[emnoc]

See the other post, that vpn cfg works for android and iOS  devices tabletas/telefonos devices. You can add more aes ciphers in your profile but it should not be required or needed.