Remote connection with IPSec VPN is not connecting

[ReneGut]

Hi,

I've been trying to create an IPSec VPN connection following the IPSec VPN Wizard but for some reason this connection is not working, I tried several ways but without any success... Any suggestion, help or ideas of how can work are welcome... 

[funkylicious]

try using the commands described here. https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-VPN-tunnels/ta-p/195955

if the ipsec params match, then make sure that you have route(s) and fw rule(s) for the ipsec.

[ReneGut]

Thank you so much for your help Funkylicious, I will check and do this asap...

[EasyDoesIT]

Have you looked through these docs?

https://docs.fortinet.com/document/fortigate/7.6.0/new-features/155142/migration-from-ssl-vpn-tunnel...

https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/155142/ssl-vpn-tunnel-mode-t...

[ReneGut]

Thank you EasyDoesIT, I will read this docs tomorrow in the morning...

[ReneGut]

Some additional details:

Firewall used: FortiGate 100F

Firmware version: 7.4.8

FortiClient version: 7.4.3.1790

Sorry, I should mention this info before...

[kaman]

Hi ReneGut,

Can you please run the below commands and share us the output here to diagnose the issue.

diagnose sniffer packet any " host <PublicIP of the Host getting disconnected> and port 500 or 4500 " 6 0 l

diagnose vpn ike log-filter clear
diagnose vpn ike log-filter src-addr4 <PublicIP of the Host getting disconnected>
diagnose debug console timestamp enable
diagnose debug application ike -1
diagnose debug enable

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-troubleshoot-Intermittent-IPSec-Dia...

Regards,
Aman

[sjoshi]

Hi @ReneGut 

While sharing the logs requested by @kaman  adjust below commands which will give your correct output.

diagnose sniffer packet any " host <PublicIP of the Host getting disconnected> and (port 500 or 4500) " 6 0 l

Since you have mentioned you are in v7.4 version the correct ike filter debug cmd is:-
diagnose vpn ike log filter rem-addr4 <PublicIP of the Host getting disconnected>

Also to clear the previous ike filter ,
diagnose vpn ike log filter clear

Additionally Notes:-

Verify both sides are having same config

Share snap of the exact error you are getting while connecting the VPN

[ReneGut]

Hello everyone,

First, I want to thank you all for your ideas and suggestions, but especially for your interest in helping me resolve connectivity issues with the FortiClient.

Below I share with you the solution applied, hoping it helps someone else who may have this problem.

1)- I did a total clean up  of my computer using the Windows PowerShell as Administrator mode:

      a) I did run the command: sfc /scannow to repair any issues with my Win11 Pro OS.

      b) I did run the command: netsh int ip reset to reset the TCP/IP stack on my Win11 Pro OS.

2)- Deleted all previous configurations of the IPSec VPN to have a fresh start again.

3)- I created a new IPSec VPN using the VPN Wizard selecting the option Remote.

4)- I did the next configuration on the FortiClient VPN for Phase 1:

5)- I did the next configuration for the Phase 2:

6)- Editing the IVPSec VPN created I selected the option Convert it to Dialup mode to edit the Phase 1 and Phase 2 to synchronize those values with the values on the FortiClient VPN configuration.

7)- I did proceed with the connection process, and the connection was resolved immediately getting the remote communication with the Firewall, as you can see in the snapshot below...