Ipsec IKEV2 remote access vpn error

[rezafathi]

Hello,

I have created a ipsec ikev2 remote access vpn but when i trying to connect to it from forticlient in android or pc it shows an error stating: "protocol timeout reached" . Here is the fortigate (V 7.6.3) vpn config:

config vpn ipsec phase1-interface
 edit "ITC VPN"
set type dynamic
set interface "port2"
set ike-version 2
set local-gw wan ip
set peertype one
set net-device disable
set mode-cfg enable
set ipv4-dns-server1 192.168.0.46
set proposal aes256-sha256
set comments "VPN: ITC VPN -- Created by VPN wizard"
set dhgrp 14
set eap enable
set eap-identity send-request
set wizard-type dialup-forticlient
set authusrgrp "IT_Users"
set transport udp
set peerid "reza"
set ipv4-start-ip 10.60.70.1
set ipv4-end-ip 10.60.70.3
set save-password enable cA2TeDH7DfQItGyaCzAdm+nyAodhdjOn3pkCw8DFQLoaMjfSMf1u69g/r/ivZ5K1Q82sP8X6ZvKzUf2ZhFxxACq3Xu8
next
end

In vpn Logs i can see that ipsec phase 1 failes with error : gateway validation failed

[Gem_Tfk]

I received the following answer from the Fortinet support:

Upon further analysis, we suspect that the issue might be due to your use of PSK for your VPN configuration and RADIUS being used for user authentication. It would appear that this combination is not supported for Android platforms at present. Kindly consider making use of the "X.509 certificate based authentication" instead of PSK.

[fguser2022]

X.509 certificate-based authentication is failing on the FortiClient Android application.

The issue is isolated to the Android client, as both the Native Android VPN and the Windows FortiClient authenticate successfully using the identical configuration.

The FortiClient Android setup followed the 'Signature' section outlined in the official documentation: https://docs.fortinet.com/document/forticlient/7.4.0/android-administration-guide/189805/creating-an...

The logs suggest the FortiClient Android is sending the peer identifier during the IKEv2 exchange.

###Forticlient
ike V=root:0:ccsikev2:142: reassembled fragmented message
ike V=root:0:ccsikev2:142: responder received AUTH msg
ike V=root:0:ccsikev2:142: received peer identifier DER_ASN1_DN 'DC = LOCAL, DC = MYDOMAIN, CN = MYDOMAIN-CA'
ike V=root:0:ccsikev2:142: re-validate gw ID
ike V=root:0:ccsikev2:142: gw validation failed

###Android Native
ike V=root:0:ccsikev2:145: reassembled fragmented message
ike V=root:0:ccsikev2:145: responder received AUTH msg
ike V=root:0:ccsikev2:145: processing notify type MOBIKE_SUPPORTED
ike V=root:0:ccsikev2:145: processing notify type ADDITIONAL_IP6_ADDRESS
ike V=root:0:ccsikev2:145: processing notify type ADDITIONAL_IP6_ADDRESS
ike V=root:0:ccsikev2:145: processing notify type EAP_ONLY_AUTHENTICATION
ike V=root:0:ccsikev2:145: processing notify type MESSAGE_ID_SYNC_SUPPORTED
ike V=root:0:ccsikev2:145: received peer identifier DER_ASN1_DN 'DC = LOCAL, DC = MYDOMAIN, OU = Managed, CN = John Doe, emailAddress = jdoe@example.com'
ike V=root:0:ccsikev2:145: re-validate gw ID
ike V=root:0:ccsikev2:145: gw validation OK