Mobile IPSec VPN not working

[Chris27]

Hello all,

I am trying to get IPSec VPN with 2FA to work on a 60F running 7.6.1

I have used the Wizard to create the VPN, and I have tried to manually set up the VPN tunnel, I have also followed the available instructions to create the tunnel via CLI.

It all ends in the same problem : I have a working P1 and P2, I get prompted for the token, and FortiClient claims it´s connected. I can see the traffic counter counting traffic to the firewall, but not receiving anything.

I have set up FortiAnalyzer, and there I can see the traffic as allowed traffic hitting the correct policy.

I can see the session in FortiView on the firewall, with traffic in both directions.

Neither traffic sniffer nor flow debug shows any packet.

I have tried two different Windows endpoints, all the same.

Spent one week on this. Where can I dig now ?

Cheers,

Chris

[salemneaz]

To troubleshoot a remote access VPN not working issue, you can follow these steps:

1. **Check Connectivity**: Ensure that the remote device has a stable internet connection. Test connectivity by trying to access other websites or services.

2. **Verify VPN Configuration**: Double-check the VPN configuration settings on the remote device. Make sure the VPN settings match the ones provided by your organization.

3. **Restart VPN Service**: Restart the VPN service on the remote device. Sometimes, a simple restart can resolve connectivity issues.

4. **Update VPN Software**: Ensure that the VPN software on the remote device is up to date. Outdated software can sometimes cause connection problems.

5. **Firewall Settings**: Check the firewall settings on the remote device. Make sure that the necessary ports for the VPN connection are open.

6. **Check VPN Server Status**: Verify that the VPN server on the organization's end is up and running. Contact your IT department to confirm the status of the VPN server.

7. **User Authentication**: Ensure that the user credentials for the VPN connection are correct. Incorrect credentials can prevent the VPN from establishing a connection.

8. **Logs and Error Messages**: Check the VPN logs on both the remote device and the VPN server for any error messages. This can provide valuable information on what might be causing the issue.

By following these steps, you should be able to troubleshoot and resolve the remote access VPN not working problem effectively.

[salemneaz]

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-FortiGate-manages-PRF-Pseudo-Random-Fu...

[Chris27]

Hello Salem,

first let me thank you for the feedback, appreciated 

But be assured that I have gone thorugh all of this. Please let me clarify that

1.) No auth failures,no errors in the logs

2.) Fortigate sits on a dedicated 1G Fiber with static IPV4

3.) I can see traffic going *to* the Fortigate from the client in FortiAnalyzer

4.) The traffic hits the correct firewall policy and is marked as accepted according to FortiAnalyzer 

5.) VPN tunnel is all green on the Fortigate

6.) If I run either a flow debug or a sniffer, it does not see the traffic on the Fortigate 

7.) Nothing is received on the client side

8.) I have two static IPSec VPNs up and running on that very Fortigate.

I have tried with and without explicit static routes into the tunnel network, I have tried bunches of different encryption algorithms, tried two different Windows machines, tried 3 way to set the VPN up on the Fortigate (Wizard, manual, CLI).

The setup is like this :

Fortigate :

Local LAN on port 1, /24, role is LAN

Tunnel network (different from LAN) /24

Firewall rule with incoming interface = VPN virtual interface, outgoing = LAN, incoming range = tunnel network, outgoing range = local LAN, services allowed = ALL

P2 on Fortigate with 0.0.0.0 for local and remote (tried with the correct ranges though, no difference)

Current setup is AES256/SHA256 DH2 for both P1 and P2

Client :

Win 10 or 11, VPN only client

Fresh install

Firewall disabled

I am out of ideas. Since the firewall is currently running in a production environment 1200 km from here, I cannot try and downgrade to 7.4 which would be my next step to try.

Maybe someone has a better idea to get this thing running. Never had so much hassle to set up a simple road warrior VPN in the last 20 years.

Cheers,

Chris

[Chris27]

Talking to myself, but today I found more time to work on this issue.

Ping from IPSec endpoit reaches the destination within the destination network - I cannot say which flow debug or sniffer on the firewall itself does not see the packet, but well.

On a linux client I can see the packets coming in with tcpdump.

So it´s the route back that is not working.

Docs say don´t add a static route. Tried with and without static route from local network via VPN virtual interface to client range. No luck.

I have now added a reverse policy for outgoing packets into the client range. Did not do the trick.

Any ideas ?

Cheers,

Chris

[Chris27]

After disabling auto-asic-offload in the corresponding policy, and enabling NAT, I can see packets going back and forth. 

XX-XX-FW1 # diag sniffer packet Mobile_VPN_0 icmp 4
interfaces=[Mobile_VPN_0]
filters=[icmp]
2.725350 Mobile_VPN_0 -- AAA.AAA.AAA.1 -> LL.LL.LL.9: icmp: echo request
2.725350 Mobile_VPN_0 -- AAA.AAA.AAA.1 -> LL.LL.LL.9: icmp: echo request
2.725550 Mobile_VPN_0 -- LL.LL.LL.9 -> AAA.AAA.AAA.1: icmp: echo reply
2.725550 Mobile_VPN_0 -- LL.LL.LL.9 -> AAA.AAA.AAA.1: icmp: echo reply
7.721270 Mobile_VPN_0 -- AAA.AAA.AAA.1 -> LL.LL.LL.9: icmp: echo request
7.721270 Mobile_VPN_0 -- AAA.AAA.AAA.1 -> LL.LL.LL.9: icmp: echo request
7.721533 Mobile_VPN_0 -- LL.LL.LL.9 -> AAA.AAA.AAA.1: icmp: echo reply
7.721533 Mobile_VPN_0 -- LL.LL.LL.9 -> AAA.AAA.AAA.1: icmp: echo reply

TCPDump on the client machine sees nothing coming back, only outgoing packets.

I can see no dropped packets in any log.

Could it be that this is a performance issue ? It´s a 60F, and there are two static VPNs up. The device does flow based inspection and is serving ~ 30 clients.

Regards,

Chris