Unable to bring down IPSec VPN Tunnnel

[#1]

Hi, i' ve configured FG200B as IPSec VPN Dialup Server, clients establish tunnels using FortiClient. but i m unable to bring down the tunnel from IPSec--->Monitor. even though clicking Bring down but still the tunnel is up :( using os 4.2 patch2 any idea??? thanks

[rwpatterson]

Wasn' t sure if more than one QM selector was used. You could always go in and mangle the QM selector in question. The phase 2 definitions would then not match and the tunnel will (should) drop. Change the subnet or one octet and save it. This should be enough to fail the relationship.

[#3]

Thanks, QM selector is same for all dialup clients. forticlients will be using Automatic configuration. regards, Zeeshan

[ede_pfau]

You could set it up like this: - set up local users on the FG (name+password) - configure each Fclient with localID==username and PSK==password_for_this_user. You can then either delete the user, change his password or just disable his/her temporarily. It' s one of the common scenarios explained in the IPSec VPN Handbook.

[#5]

this will work, but forticlients will b on automatic configuration, and they are authenticated using RADIUS server.

[ede_pfau]

what will stop you from taking a user out of RADIUS then?? RADIUS or local user list, both are equivalent in this respect.

[#7]

user is successfully disconnected from RADIUS, but FG doesn' t go for authentication again