OpenVPN and Fortigate SSL?

[csmIT]

Has anyone connected an OpenVPN client PC to a Fortigate SSL VPN? I' m trying to connect a linux server (no GUI) to our network via the Fortigate (200B) SSL VPN. Any example configs would be appreciated. Or, should I rather use IPSec? Best Nik

[emnoc]

they are not compatible. If you have a client pc that needs vpn access, use a ipsec client or a sslclient ( forticlient ) .

[csmIT]

Thanks emnoc. The problem is that I do not run a GUI at all on the client. Do you know if IPSec (command line) would work? I have created an IPSec VPN and connected successfully with my Mac and Windows PC via their built in IPSec clients (not fortigate software) so I assume IPSec via command line would work on Linux? -Nik

[emnoc]

I' ve used the cisco vpnclient and strongswan from cli. Either one of these should be good for ipsec. Fortigate has forticlient for macosx or linux ( iirc ). Maybe you can getting these working from a cli also.

[csmIT]

That' s the direction I' m looking at now. I' ve also come across something called OpenConnect VPN which is supposed to connect to SSL VPN' s on Cisco devices. Have you looked at that setup too?

[emnoc]

OpenConnect

Yes, it works but the cisco client is way much better in my opinion. It' s beta and use at your risk.

[csmIT]

I don' t have a cisco TAC account so I can' t download the cisco client. I' m attempting to use vpnc on ubuntu. So far it' s not working, I get a " no response from target. Looking at the logs on the FG it is saying; ike 0: IKEv1 Aggressive, comes 23.2.143.80:54981->207.69.179.34 14, peer-id=L2TPClients . ike 0: no IKEv1 phase1 configuration matching 23.2.143.80:54981->207.69.179.34 14 ike shrank heap by 118784 bytes ike shrank heap by 8192 bytes ------------------ Looks like I need the handshaking parameters for IKE. Do you have an example config I can have a look at? Thanks Nick

[emnoc]

Basically for vpnc, it' s very simple. You will need to modify your vpnc.conf file and place the group, xauth information. Now what that said, I never used it against a fortigate, but the setup should be the same. I would be suspected of what to apply for the group setting but I' m sure it would be remote-peer identify. You will have to play around with it. I' m doing some FGT-3040 install next week, so maybe I might give it a try and see what happens on one of my VMs. Here' s my vpnc.conf that I use to a ASA. # IKE Authmode hybrid IKE DH group dh2 IPSec gateway vpn01.xxxx.net IPSec ID RAWARRIOR IPSec secret Ims0s3cur3d IPSec target network 10.20.87.0/255.255.255.0 IKE Authmode PSK Xauth username neteng-admin Xauth password Temporary # note: LinuxOS = Debian Lenny with bigmem kernel support but I don' t think I had to do anything special within the kernel or recompile anything. You might be better off using the shrewclient or the real cisco IPSCE client to test ALL parameters and then craft the same for vpnc setting on your LinuxOS. This way you can conduct better diagnostics and get better debug information, and less beating your head into the wall. I did this when working on how to use my cisco IPSEC client against a fortigate and yes, I got it to worked :) Same as with the vpnclient or vpnc, you can import a .pcf file extension for cisco into your env and conduct all on the CLI with no interaction. I did this when crafting some linux-fw-gateway devices and in the same fashion of what the cisco EzVPN does for client xauth access. I don' t think Fortinet has ever came up with something similar ( a PCF file ) that would allow you to hand over all of the vpn-gw information, and just have one pre-configuration file to ease remote-access VPNs. I think you will have to do some experimentation, no matter what path you go. But I pretty much try all of the above with 3des/AES128 and your choice of diffiehellman group 2 and with PSK or hybrid ( PSK +xauth ). I never tried any of the above with pfs enabled btw. Like I suggested above, you have to play around with it. On my ASAs it was quite simple to craft a tunnel-group for iPhone/Androids and then one for other users and get it all working with little problems. Only my androids had problems and mainly withe sslvpn and OpenVPN connections.

[csmIT]

Thanks emnoc, but this config gives the exact same results as before " no IKEv1 phase1 configuration matching..." I' ll try a couple more things. N

[emnoc]

So how is your ike p1 proposals set on the vpn-gateway? If the key doesn' t match you will get that same error. What you might want to do is try the -natt-mode force-natt if you think it' s NAT-T related. vpnc --debug 100 --natt-mode natt or force-natt Since your doing this from a command line, tcpdump your connection that gateway and look for any responses and the same for the fortigate. Make sure ike is getting thru and that you see trafic before the ESP proto. Like I said, vpnc was hit or miss with working. I always use the shrewsoft client 1st to weed out any configuration parameters and then tackle it with the cli binaries. I do agreed that fortigate should rethink their positions in the linux market and produce something simple and quick for CLI or crontab scripts with auto connections either ssl or ipsec VPNs.