Ipsec for Windows and Mac users ?

[kawkaw]

Hello to everyone,

I used ipsec wizard to create a "native L2TP/Ipsec" vpn.

For Windows user all work fine.

For mac user some time they cant connect.

Can some one tell me the best way to give vpn access to mac and windows user pls ?

Thanks in advance. 

[nnair]

Dear,
Kindly check the below link for the configuration.

https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/386346/l2tp-over-ipsec

[YBKruthi]

Hello @kawkaw ,

If you're experiencing issues with the native L2TP/IPSec VPN on Mac, you might want to check the VPN server logs and the Mac's system logs for any error messages that could provide insights into the connection problems. Additionally, make sure that the macOS version and L2TP/IPSec settings on the Mac clients are compatible with your VPN server configuration.

let us  know if you find any errors so it helps to  assist you.

Thanks,

[tthrilok]

Hi Kawkaw,

Thank you for the query!

Could you please confirm if you are seeing the IKE packets on the firewall when you are trying the L2TP from your mac machines?

You may run the below debugs on the firewall:

di de reset

di vpn ike log-filter clear

di vpn ike log-filter dst-addr4 x.x.x.x

di de app ike -1

di de en

Please run the above debug commands please try to connect the VPN from mac and once the error is seen, please stop the debug using:

di de di

di de reset

+ Please share the above outputs.

Thank you!

Thallapelly Thrilok.

[sail81]

Why wouldn’t you solve this in a more BYOD fashion by providing instructions or scripts to setup like a university (or if you own the endpoints via some config management) and use forticlient which supports ikev2 on windows, the built in one for mac which supports v2 since 10.11 and StrongSwan or NetworkManager on Linux.

[Christian_89]

Apologies for the confusion. If you are using a FortiGate firewall to provide VPN access to both Mac and Windows users, here's what you can do:

1. For Windows users:
- FortiGate supports various VPN protocols for Windows, including SSL-VPN, IPsec, and L2TP/IPsec. You can configure SSL-VPN using FortiClient, which is a dedicated VPN client provided by Fortinet. It offers a more seamless and feature-rich VPN experience for Windows users. FortiClient supports both SSL-VPN and IPsec VPN connections.
- Alternatively, you can also use the built-in Windows VPN client and configure IPsec or L2TP/IPsec VPN on the FortiGate firewall. Ensure that you follow the FortiGate documentation for step-by-step instructions on configuring the appropriate VPN protocol for Windows users.

2. For Mac users:
- FortiClient also provides a dedicated VPN client for Mac users. You can download and install FortiClient for Mac, which supports SSL-VPN and IPsec VPN connections. FortiClient for Mac offers similar functionality as the Windows version.
- For native VPN support on macOS, you can configure L2TP/IPsec VPN or SSL-VPN on the FortiGate firewall. Mac users can use the built-in VPN client to connect to these VPN types. Follow the FortiGate documentation to configure the appropriate VPN protocol for Mac users.

When configuring VPN on the FortiGate firewall, make sure you configure the appropriate firewall policies, user authentication, and encryption settings based on your security requirements. You may also need to open the necessary ports on your firewall and configure any NAT or routing rules if applicable.

For troubleshooting connection issues, consult the Fortinet documentation, which provides detailed information on diagnosing and resolving VPN connectivity problems specific to FortiGate firewalls. Additionally, you can reach out to Fortinet support for further assistance in troubleshooting and resolving any issues you may encounter.

Remember to keep your FortiGate firmware up to date and apply any recommended security patches to ensure the best performance and security for your VPN solution.

[petergray]

If Mac users can't connect to your IPsec VPN, check the compatibility of IPsec settings between the VPN server and clients, verify the pre-shared key (PSK) on both ends, and ensure Mac clients use the correct "Cisco IPSec" VPN type. Also, review Mac clients' firewall settings for potential blocks. If issues persist, consider trying third-party VPN clients like NCP Secure Entry Client Suite or Cisco AnyConnect VPN Client, which simplify configuration.

For granting VPN access to Mac and Windows users, options include using third-party VPN clients for ease, native IPsec VPN client for added security (though more complex setup), or a VPN gateway (physical or virtual) for enhanced features and flexibility. Choose the best option based on your specific needs and requirements.