Internet connection lost when trying to connect to a Fortigate with IPsec VPN through Forticlient

[Alejandro77]

Hello guys,

not sure if someone else has the same issue, but there are times when I'm trying to set up a remote connection tunnel via IPsec and this issue comes up... I'm trying to connect through Forticlient VPN but internet connection stops, the tunnel is (of course) down and the internet access is restored.

[AEK]

Hi Alejandro

Can you share your routing table when IPsec connection is down and when it is up?

[Alejandro77]

that was my first thought too and I checked it.. it was identical! Perhaps I'll need to rephrase: While trying to connect, internet dropped, so the connection never happened. I checked the routing table both times and it was identical

[AEK]

Did you enter the remote server as fqdn or ip?

Also can you share the ipsec config? I mean from FGT side.

[Debbie_FTNT]

It does sound a bit like FortiClient/routing may be set up to send everything through the VPN tunnel (no split-tunnel), and if FortiGate lacks the policies to allow this, internet access would essentially be down after VPN is established.

[Alejandro77]

My apologies for the (far too) late reply, but it seems that I'm seeing this issue again and again... The remote server was set by using an fqdn.

Here's the config:

config vpn ipsec phase1-interface
edit "for_client"
set type dynamic
set interface "wan1"
set mode aggressive
set peertype one
set net-device enable
set mode-cfg enable
set proposal aes256-sha256
set dpd on-idle
set xauthtype auto
set authusrgrp "vpngroup"
set peerid "dialup1"
set assign-ip-from name
set dns-mode auto
set ipv4-split-include "0_Subnet_LAN"
set ipv4-name "client_range"
set save-password enable
set psksecret ENC LU+SJKLoLEZeByKcux+fsYTu2023cGoAahQ5f0aKK9Z1d//Y5Mv6hzmA+EfRohvNrypTOe4KLP9hSwpBKZEEQn99/sy0GfJ9yX/CxKbXUwvWAcqklOA2w96lhiygeKkikGfRZQ8GAm2anH2jsZa7I8V2hGpt6rAARV5Y4j3pagf739IapjLlPa3qnjU3gqQZNU+fug==
set dpd-retryinterval 60
next
end

config vpn ipsec phase2-interface
edit "for_client"
set phase1name "for_client"
set proposal aes256-sha256
next
end

[AEK]

• Can you share what is inside the object 0_Subnet_LAN?
• Can it ping 1.1.1.1 (I mean IP, not fqdn) after connecting to VPN?

[Alejandro77]

Replying to your first question, the 0_Subnet_LAN is the local subnet [192.168.1.0/24] that I'm trying to reach when away!!

As far as the second question is concerned, i think that I don't quite understand what you are asking me. I'm away from my network, I open FortiClient and at the same time I'm pinging 1.1.1.1. I'm pinging normally, ok? When I try to connect to the VPN, I lose 3 pings (to 1.1.1.1) then I start pinging 1.1.1.1 again and I get a message about VPN not being able to connect

[funkylicious]

hi,

try adding in your FCT config the following lines under <ike_settings>.

First you need to export the config file, in FCT click the Lock ( last on the right ) button and in the Settings ( wheel ) Backup the config file, set a password and save it.

The locally saved file edit it with a text editor, add the lines under previous mentioned section, save and then Restore the saved file with the new settings.

<implied_SPDO>1</implied_SPDO>

<implied_SPDO_timeout>120</implied_SPDO_timeout>

[Alejandro77]

I can export a configuration, but I cannot restore it afterwards...