Settings for Connecting Avaya VPN Remote IP Phone to Fortigate

[#1]

I have been struggling with setting up an Avaya 5610SW IP phone with the builtin Avaya VPN Remote client to a Fortigate FG60. I finally got it working tonight, so for the benefit of others, here is the configuration I used: On the 5610SW phone: VPN Profile Generic PSK Server XXX.XXX.XXX.XXX IKE ID [I used " vpn" , but you can set this as " any" in the Fortigate and then put anything you like] PSK – (Pre Shared Key) ******** IKE Parameters IKE ID Type FQDN Diffie Hellman Group 2 Encryption ALG Any Authentication ALG Any IKE Xchange Mode Aggressive IKE Config Mode Disabled XAUTH Disable Cert Expiry Check Disabled Cert DN Check Disabled IPSEC Parameters Encryption ALG 3DES Authentication ALG Sha1 Diffie Hellman Group 2 VPN Start Mode Boot Password Type Save in Flash Encapsulation 4500 – 4500 Protected Nets Virtual IP 192.168.0.210 Remote Net #1 192.168.0.0/24 Remote Net #2 Remote Net #3 Copy TOS No Connectivity Check Always QTEST Disabled On the FG60: Phase 1 " VPNPHONE" set type dynamic set interface " wan1" set local-gw 0.0.0.0 set localid ' ' set dpd enable set nattraversal enable set dhgrp 2 set proposal 3des-sha1 3des-md5 set keylife 28800 set authmethod psk set peertype any set xauthtype disable set mode aggressive set add-gw-route disable set distance 1 set priority 0 set psksecret ENC **************************************** set dpd-retrycount 3 set dpd-retryinterval 5 set keepalive 10 next Phase 2 " VPNPHONE" set auto-negotiate enable set dhgrp 2 set dst-addr-type subnet set dst-port 0 set keepalive enable set keylife-type seconds set pfs enable set phase1name " VPNPHONE" set proposal 3des-sha1 3des-md5 set protocol 0 set replay enable set route-overlap use-new set single-source disable set src-addr-type subnet set src-port 0 set use-natip enable set dhcp-ipsec enable set dst-subnet 0.0.0.0 0.0.0.0 set keylifeseconds 1800 set src-subnet 0.0.0.0 0.0.0.0 As a point of reference, it appears the 5610 doesn' t like using Diffe Hillman Group 5. As with other firewalls and the 5610, changing to DH Group 2 fixed things right up. Hope this helps some folks!