Ipsec IKEV2 remote access vpn error

[rezafathi]

Hello,

I have created a ipsec ikev2 remote access vpn but when i trying to connect to it from forticlient in android or pc it shows an error stating: "protocol timeout reached" . Here is the fortigate (V 7.6.3) vpn config:

config vpn ipsec phase1-interface
 edit "ITC VPN"
set type dynamic
set interface "port2"
set ike-version 2
set local-gw wan ip
set peertype one
set net-device disable
set mode-cfg enable
set ipv4-dns-server1 192.168.0.46
set proposal aes256-sha256
set comments "VPN: ITC VPN -- Created by VPN wizard"
set dhgrp 14
set eap enable
set eap-identity send-request
set wizard-type dialup-forticlient
set authusrgrp "IT_Users"
set transport udp
set peerid "reza"
set ipv4-start-ip 10.60.70.1
set ipv4-end-ip 10.60.70.3
set save-password enable cA2TeDH7DfQItGyaCzAdm+nyAodhdjOn3pkCw8DFQLoaMjfSMf1u69g/r/ivZ5K1Q82sP8X6ZvKzUf2ZhFxxACq3Xu8
next
end

In vpn Logs i can see that ipsec phase 1 failes with error : gateway validation failed

[funkylicious]

hi,

there a new feature/setting that is currently enabled by default on 7.6 that looks for FortiClient if it's EMS managed or not.

So if you have a VPN Only version of FortiClient, try disabling that

config system global
    set vpn-ems-sn-check {enable | disable}
end

[rezafathi]

Hi 

there is no such command.

[funkylicious]

my bad, in 7.6.3 it's under phase1 settings

config vpn ipsec phase1-interface
    edit <name>
        set ems-sn-check {enable | disable}
    next
end

[rezafathi]

no it wan not solved. same error

[funkylicious]

have a look at this.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-fix-gw-validation-failed-error-IPse... 

[rezafathi]

I did all the steps but same error shows.

[funkylicious]

give it a shot w/o peer id / local id config

[rezafathi]

Here is the ike debug log:  

ike V=root:0: comes 5.22.40.135:41273->X.X.X.X:500,ifindex=8,vrf=0,len=500....
ike V=root:0: IKEv2 exchange=SA_INIT id=ec1978e6ab328306/0000000000000000 len=500
ike 0: in EC1978E6AB32830600000000000000002120220800000000000001F42200005C0200002C010100040300000C0100000C800E0100030000080300000C030000080400000E000000080200000500000
02C020100040300000C0100000C800E00800300000803000002030000080400000E000000080200000228000108000E0000239084C0CAC21B2959E0C693CBEA1889054D17F327F8D76471AC6F970334873D2332
701501FA60F34B88D2EF04FCD0D89620EC63F066A5A4770263FB8DAE1C612BBDB18E8EAA037F1C22A124B341D932B86D13E766AF735F1AA61B4EF2CE95AA60A61A3D2E5938EA1AD798BA63869CFEA334EB15491
CEA13F31C7952E70EB222275924EB90CD861A233FCC6BB649CA806D72321D51BDD83D42B4D3C649C3D1A243C80E980221C89827A4F8C8CD1A89E667BECE76371515CD6BFC89E7003E50AF72BFFC7D772CF198E5
CE2DC8428D977CB3E0169CB8079409836C47C8FE9CB2106AE1F07A4C202DF7DF6641F798A611004D0CEE1AB53B422ED67EDCE47F770E1D29000024CBEC9AD940D470DA4C6BEC84A378D862EC06F0D181BCE0CF0
6A4D800C527D9452900001C000040044B673461480D46D320429A204E774FC7CC20DE6D2900001C00004005AF27935822A5B2922C0CB893E3A709F15D5EE307290000080000402E000000100000402F00010002
00030004
ike V=root:0:ec1978e6ab328306/0000000000000000:256: responder received SA_INIT msg
ike V=root:0:ec1978e6ab328306/0000000000000000:256: received notify type NAT_DETECTION_SOURCE_IP
ike V=root:0:ec1978e6ab328306/0000000000000000:256: received notify type NAT_DETECTION_DESTINATION_IP
ike V=root:0:ec1978e6ab328306/0000000000000000:256: received notify type FRAGMENTATION_SUPPORTED
ike V=root:0:ec1978e6ab328306/0000000000000000:256: received notify type SIGNATURE_HASH_ALGORITHMS
ike V=root:0:ec1978e6ab328306/0000000000000000:256: incoming proposal:
ike V=root:0:ec1978e6ab328306/0000000000000000:256: proposal id = 1:
ike V=root:0:ec1978e6ab328306/0000000000000000:256: protocol = IKEv2:
ike V=root:0:ec1978e6ab328306/0000000000000000:256: encapsulation = IKEv2/none
ike V=root:0:ec1978e6ab328306/0000000000000000:256: type=ENCR, val=AES_CBC (key_len = 256)
ike V=root:0:ec1978e6ab328306/0000000000000000:256: type=INTEGR, val=AUTH_HMAC_SHA2_256_128
ike V=root:0:ec1978e6ab328306/0000000000000000:256: type=PRF, val=PRF_HMAC_SHA2_256
ike V=root:0:ec1978e6ab328306/0000000000000000:256: type=DH_GROUP, val=MODP2048.
ike V=root:0:ec1978e6ab328306/0000000000000000:256: proposal id = 2:
ike V=root:0:ec1978e6ab328306/0000000000000000:256: protocol = IKEv2:
ike V=root:0:ec1978e6ab328306/0000000000000000:256: encapsulation = IKEv2/none
ike V=root:0:ec1978e6ab328306/0000000000000000:256: type=ENCR, val=AES_CBC (key_len = 128)
ike V=root:0:ec1978e6ab328306/0000000000000000:256: type=INTEGR, val=AUTH_HMAC_SHA_96
ike V=root:0:ec1978e6ab328306/0000000000000000:256: type=PRF, val=PRF_HMAC_SHA
ike V=root:0:ec1978e6ab328306/0000000000000000:256: type=DH_GROUP, val=MODP2048.
ike V=root:0:ec1978e6ab328306/0000000000000000:256: matched proposal id 1
ike V=root:0:ec1978e6ab328306/0000000000000000:256: proposal id = 1:
ike V=root:0:ec1978e6ab328306/0000000000000000:256: protocol = IKEv2:
ike V=root:0:ec1978e6ab328306/0000000000000000:256: encapsulation = IKEv2/none
ike V=root:0:ec1978e6ab328306/0000000000000000:256: type=ENCR, val=AES_CBC (key_len = 256)
ike V=root:0:ec1978e6ab328306/0000000000000000:256: type=INTEGR, val=AUTH_HMAC_SHA2_256_128
ike V=root:0:ec1978e6ab328306/0000000000000000:256: type=PRF, val=PRF_HMAC_SHA2_256
ike V=root:0:ec1978e6ab328306/0000000000000000:256: type=DH_GROUP, val=MODP2048.
ike V=root:0:ec1978e6ab328306/0000000000000000:256: lifetime=86400
ike V=root:0:ec1978e6ab328306/0000000000000000:256: SA proposal chosen, matched gateway ITC VPN
ike V=root:0:ITC VPN:ITC VPN: created connection: 0x2b4044996720 8 X.X.X.X->5.22.40.135:41273.
ike V=root:0:ITC VPN:256: processing notify type NAT_DETECTION_SOURCE_IP
ike V=root:0:ITC VPN:256: processing NAT-D payload
ike V=root:0:ITC VPN:256: NAT detected: PEER
ike V=root:0:ITC VPN:256: process NAT-D
ike V=root:0:ITC VPN:256: processing notify type NAT_DETECTION_DESTINATION_IP
ike V=root:0:ITC VPN:256: processing NAT-D payload
ike V=root:0:ITC VPN:256: NAT detected: PEER
ike V=root:0:ITC VPN:256: process NAT-D
ike V=root:0:ITC VPN:256: processing notify type FRAGMENTATION_SUPPORTED
ike V=root:0:ITC VPN:256: processing notify type SIGNATURE_HASH_ALGORITHMS
ike V=root:0:ITC VPN:256: responder preparing SA_INIT msg
ike V=root:0:ITC VPN:256: create NAT-D hash local X.X.X.X/500 remote 5.22.40.135/41273
ike 0:ITC VPN:256: out EC1978E6AB3283063B841177378C779E2120222000000000000001A8220000300000002C010100040300000C0100000C800E01000300000802000005030000080300000C00000008
0400000E28000108000E0000D95E456983EE3BDE3C5925075486937E87CDF94B77ABDB21068DC3D7A62D0D959F3F40B182555C100CC9FCFD6EFA81D26A407052AC64A82EA829ED7E178EAB67BD652EB1CDF741F
DC1BCE4B6EFE23D465DCA0CE3B9F9F5805D548C84A78CDF1CBAAE8E2F7C4BBB8B47CD116703CACA170798FE54C7FEE27541028EFF530BC4722A9C937232370122C7E5C43B8ED4E3503C36723CA02568017641C5
8AD56E14385C132615EC0F61600ECBCC4994B01CFC837943CAA7790FFBE3333DCB8ADAF4D1284D9A86106938A201BF552811442F0C6429650CD8821CE6A17F4C310685BDDC496725610E86ACF29742628C442CB
8D13B8BA7EF272D45C3D17F268BA048F35A29000014A3ADF53EDD606C04A079125DF21AE8452900001C000040043C24E260BDF510CD3A6E0550B8689405155BCDB62900001C0000400550F2113CFD22A1673A6F
B1982C273E91BA61AFB5000000080000402E
ike V=root:0:ITC VPN:256: sent IKE msg (SA_INIT_RESPONSE): X.X.X.X:500->5.22.40.135:41273, len=424, vrf=0, id=ec1978e6ab328306/3b841177378c779e, oif=8
ike 0:ITC VPN:256: IKE SA ec1978e6ab328306/3b841177378c779e SK_ei 32:0A89CB6A75F9883790AF5378C00B239C3D069CD39CD0923AF34B434B71D36113
ike 0:ITC VPN:256: IKE SA ec1978e6ab328306/3b841177378c779e SK_er 32:1978BB3CF0C7E0F701834B9E2F13CC65B7C955053FCB6D5BF7CE3313CC572471
ike 0:ITC VPN:256: IKE SA ec1978e6ab328306/3b841177378c779e SK_ai 32:2B4D4DE24DC4BD3A5DE5299A049276C55A8BB9D9EB5DD3CA8C41B944F7A7DE99
ike 0:ITC VPN:256: IKE SA ec1978e6ab328306/3b841177378c779e SK_ar 32:3548A903791AE25E1CC1280C2C2E7FD86CC7229890D32CE656FF49F94D0A2067
ike V=root:0: comes 5.22.40.135:41273->X.X.X.X:500,ifindex=8,vrf=0,len=500....
ike V=root:0: IKEv2 exchange=SA_INIT id=ec1978e6ab328306/0000000000000000 len=500
ike 0: in EC1978E6AB32830600000000000000002120220800000000000001F42200005C0200002C010100040300000C0100000C800E0100030000080300000C030000080400000E000000080200000500000
02C020100040300000C0100000C800E00800300000803000002030000080400000E000000080200000228000108000E0000239084C0CAC21B2959E0C693CBEA1889054D17F327F8D76471AC6F970334873D2332
701501FA60F34B88D2EF04FCD0D89620EC63F066A5A4770263FB8DAE1C612BBDB18E8EAA037F1C22A124B341D932B86D13E766AF735F1AA61B4EF2CE95AA60A61A3D2E5938EA1AD798BA63869CFEA334EB15491
CEA13F31C7952E70EB222275924EB90CD861A233FCC6BB649CA806D72321D51BDD83D42B4D3C649C3D1A243C80E980221C89827A4F8C8CD1A89E667BECE76371515CD6BFC89E7003E50AF72BFFC7D772CF198E5
CE2DC8428D977CB3E0169CB8079409836C47C8FE9CB2106AE1F07A4C202DF7DF6641F798A611004D0CEE1AB53B422ED67EDCE47F770E1D29000024CBEC9AD940D470DA4C6BEC84A378D862EC06F0D181BCE0CF0
6A4D800C527D9452900001C000040044B673461480D46D320429A204E774FC7CC20DE6D2900001C00004005AF27935822A5B2922C0CB893E3A709F15D5EE307290000080000402E000000100000402F00010002
00030004
ike V=root:0:ITC VPN:256: detected retransmit, resend last message
ike 0:ITC VPN:256: out EC1978E6AB3283063B841177378C779E2120222000000000000001A8220000300000002C010100040300000C0100000C800E01000300000802000005030000080300000C00000008
0400000E28000108000E0000D95E456983EE3BDE3C5925075486937E87CDF94B77ABDB21068DC3D7A62D0D959F3F40B182555C100CC9FCFD6EFA81D26A407052AC64A82EA829ED7E178EAB67BD652EB1CDF741F
DC1BCE4B6EFE23D465DCA0CE3B9F9F5805D548C84A78CDF1CBAAE8E2F7C4BBB8B47CD116703CACA170798FE54C7FEE27541028EFF530BC4722A9C937232370122C7E5C43B8ED4E3503C36723CA02568017641C5
8AD56E14385C132615EC0F61600ECBCC4994B01CFC837943CAA7790FFBE3333DCB8ADAF4D1284D9A86106938A201BF552811442F0C6429650CD8821CE6A17F4C310685BDDC496725610E86ACF29742628C442CB
8D13B8BA7EF272D45C3D17F268BA048F35A29000014A3ADF53EDD606C04A079125DF21AE8452900001C000040043C24E260BDF510CD3A6E0550B8689405155BCDB62900001C0000400550F2113CFD22A1673A6F
B1982C273E91BA61AFB5000000080000402E
ike V=root:0:ITC VPN:256: sent IKE msg (retransmit): X.X.X.X:500->5.22.40.135:41273, len=424, vrf=0, id=ec1978e6ab328306/3b841177378c779e, oif=8
ike V=root:0: comes 5.22.40.135:47858->X.X.X.X:4500,ifindex=8,vrf=0,len=372....
ike V=root:0: IKEv2 exchange=AUTH id=ec1978e6ab328306/3b841177378c779e:00000001 len=368
ike 0: in EC1978E6AB3283063B841177378C779E2E202308000000010000017023000154B038CE1B0CBB668918350BFE175688B925CF857FF6DB2D51805958EB758F9D59F94282C05AF2A5216FA517C52FC11
4B26FCA2FD7F71B0F2713694916968C2D633B54B766CEFD66760FFB1191E2F6926134A578DE900EF4C36E9471F87D1F99D194563DD2C08D316593569C2BFD8DB29C211C9C1855128D9C3927B8E9EDC7437CA250
349A3BA67C47BA16EA4DE61E0316E306DFA344734129DEBFC594626029689CBE2289ED3EAB002940DDE920E199C71E3E960A0774D4261C0DAED5CC9CBFF9DE16E7C2329CC1A23A3975C86A7123F0D558193CA1F
7AA93ED60508A7C8D930539EBB8093D64F9B38BDE99B6C4FA9719320215B0AAB6C42D5EFC397E7E1B5F29A7C5F1FFEC6A353B473BEA25FA106DA1B04BC3522A3D0E78BFB1FF91D31509AC08FC8C0CFF45B6858A
8E43FAF5876C6A40884E3386F4A46208550E968CC580E527A4B3046A0388524880EF3889EC3092
ike 0:ITC VPN:256: dec EC1978E6AB3283063B841177378C779E2E2023080000000100000148230000042400000C0B00000072657A61270000080B00000021000028020000000FA634E1FE39ADC6D1ED0088
BF35A7A0AA3DC39D63C23B51283CC5E783EF0A482C000054020000280103040358035A010300000C0100000C800E0100030000080300000C0000000805000000000000280203040327D23EA70300000C0100000
C800E0080030000080300000200000008050000002D00004002000000070000100000FFFF00000000FFFFFFFF080000280000FFFF00000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FF2F00004002000000070000100000FFFF00000000FFFFFFFF080000280000FFFF00000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000001801000000000100000003000000020
00000070000
ike V=root:0:ITC VPN:256: responder received AUTH msg
ike V=root:0:ITC VPN:256: received peer identifier KEY_ID 'reza'
ike V=root:0:ITC VPN:256: re-validate gw ID
ike V=root:0:ITC VPN:256: gw validation failed
ike V=root:ITC VPN Negotiate SA Error: gateway validation failed
ike V=root:0:ITC VPN:256: schedule delete of IKE SA ec1978e6ab328306/3b841177378c779e
ike V=root:0:ITC VPN:256: scheduled delete of IKE SA ec1978e6ab328306/3b841177378c779e
ike V=root:0:ITC VPN: connection expiring due to phase1 down
ike V=root:0:ITC VPN: going to be deleted
ike V=root:0: comes 5.22.40.135:47858->X.X.X.X:4500,ifindex=8,vrf=0,len=372....
ike V=root:0: IKEv2 exchange=AUTH id=ec1978e6ab328306/3b841177378c779e:00000001 len=368
ike 0: in EC1978E6AB3283063B841177378C779E2E202308000000010000017023000154B038CE1B0CBB668918350BFE175688B925CF857FF6DB2D51805958EB758F9D59F94282C05AF2A5216FA517C52FC11
4B26FCA2FD7F71B0F2713694916968C2D633B54B766CEFD66760FFB1191E2F6926134A578DE900EF4C36E9471F87D1F99D194563DD2C08D316593569C2BFD8DB29C211C9C1855128D9C3927B8E9EDC7437CA250
349A3BA67C47BA16EA4DE61E0316E306DFA344734129DEBFC594626029689CBE2289ED3EAB002940DDE920E199C71E3E960A0774D4261C0DAED5CC9CBFF9DE16E7C2329CC1A23A3975C86A7123F0D558193CA1F
7AA93ED60508A7C8D930539EBB8093D64F9B38BDE99B6C4FA9719320215B0AAB6C42D5EFC397E7E1B5F29A7C5F1FFEC6A353B473BEA25FA106DA1B04BC3522A3D0E78BFB1FF91D31509AC08FC8C0CFF45B6858A
8E43FAF5876C6A40884E3386F4A46208550E968CC580E527A4B3046A0388524880EF3889EC3092
ike V=root:0: invalid IKE request SPI ec1978e6ab328306/3b841177378c779e:00000001
ike V=root:0: comes 5.22.40.135:47858->X.X.X.X:4500,ifindex=8,vrf=0,len=372....
ike V=root:0: IKEv2 exchange=AUTH id=ec1978e6ab328306/3b841177378c779e:00000001 len=368
ike 0: in EC1978E6AB3283063B841177378C779E2E202308000000010000017023000154B038CE1B0CBB668918350BFE175688B925CF857FF6DB2D51805958EB758F9D59F94282C05AF2A5216FA517C52FC11
4B26FCA2FD7F71B0F2713694916968C2D633B54B766CEFD66760FFB1191E2F6926134A578DE900EF4C36E9471F87D1F99D194563DD2C08D316593569C2BFD8DB29C211C9C1855128D9C3927B8E9EDC7437CA250
349A3BA67C47BA16EA4DE61E0316E306DFA344734129DEBFC594626029689CBE2289ED3EAB002940DDE920E199C71E3E960A0774D4261C0DAED5CC9CBFF9DE16E7C2329CC1A23A3975C86A7123F0D558193CA1F
7AA93ED60508A7C8D930539EBB8093D64F9B38BDE99B6C4FA9719320215B0AAB6C42D5EFC397E7E1B5F29A7C5F1FFEC6A353B473BEA25FA106DA1B04BC3522A3D0E78BFB1FF91D31509AC08FC8C0CFF45B6858A
8E43FAF5876C6A40884E3386F4A46208550E968CC580E527A4B3046A0388524880EF3889EC3092
ike V=root:0: invalid IKE request SPI ec1978e6ab328306/3b841177378c779e:00000001
ike V=root:0: comes 5.22.40.135:47858->X.X.X.X:4500,ifindex=8,vrf=0,len=372....
ike V=root:0: IKEv2 exchange=AUTH id=ec1978e6ab328306/3b841177378c779e:00000001 len=368
ike 0: in EC1978E6AB3283063B841177378C779E2E202308000000010000017023000154B038CE1B0CBB668918350BFE175688B925CF857FF6DB2D51805958EB758F9D59F94282C05AF2A5216FA517C52FC11
4B26FCA2FD7F71B0F2713694916968C2D633B54B766CEFD66760FFB1191E2F6926134A578DE900EF4C36E9471F87D1F99D194563DD2C08D316593569C2BFD8DB29C211C9C1855128D9C3927B8E9EDC7437CA250
349A3BA67C47BA16EA4DE61E0316E306DFA344734129DEBFC594626029689CBE2289ED3EAB002940DDE920E199C71E3E960A0774D4261C0DAED5CC9CBFF9DE16E7C2329CC1A23A3975C86A7123F0D558193CA1F
7AA93ED60508A7C8D930539EBB8093D64F9B38BDE99B6C4FA9719320215B0AAB6C42D5EFC397E7E1B5F29A7C5F1FFEC6A353B473BEA25FA106DA1B04BC3522A3D0E78BFB1FF91D31509AC08FC8C0CFF45B6858A
8E43FAF5876C6A40884E3386F4A46208550E968CC580E527A4B3046A0388524880EF3889EC3092
ike V=root:0: invalid IKE request SPI ec1978e6ab328306/3b841177378c779e:00000001
ike V=root:0: comes 5.22.40.135:47858->X.X.X.X:4500,ifindex=8,vrf=0,len=372....
ike V=root:0: IKEv2 exchange=AUTH id=ec1978e6ab328306/3b841177378c779e:00000001 len=368
ike 0: in EC1978E6AB3283063B841177378C779E2E202308000000010000017023000154B038CE1B0CBB668918350BFE175688B925CF857FF6DB2D51805958EB758F9D59F94282C05AF2A5216FA517C52FC11
4B26FCA2FD7F71B0F2713694916968C2D633B54B766CEFD66760FFB1191E2F6926134A578DE900EF4C36E9471F87D1F99D194563DD2C08D316593569C2BFD8DB29C211C9C1855128D9C3927B8E9EDC7437CA250
349A3BA67C47BA16EA4DE61E0316E306DFA344734129DEBFC594626029689CBE2289ED3EAB002940DDE920E199C71E3E960A0774D4261C0DAED5CC9CBFF9DE16E7C2329CC1A23A3975C86A7123F0D558193CA1F
7AA93ED60508A7C8D930539EBB8093D64F9B38BDE99B6C4FA9719320215B0AAB6C42D5EFC397E7E1B5F29A7C5F1FFEC6A353B473BEA25FA106DA1B04BC3522A3D0E78BFB1FF91D31509AC08FC8C0CFF45B6858A
8E43FAF5876C6A40884E3386F4A46208550E968CC580E527A4B3046A0388524880EF3889EC3092
ike V=root:0: invalid IKE request SPI ec1978e6ab328306/3b841177378c779e:00000001