VPN IPSEC + Forticlient [ can't make it working]

[anthony_hgh]

Hi, 

I'm trying to use the VPN IPSEC provided with the Fortigate 80C appliance. 

On the client side, I want to use the FORTICLIENT software. 

My 80C is running with firware v5.2.6, build 711

My Client is running on Win7 Pro and FORTICLIENT 5.4.0.0780

I have configured the VPN tunnel using the wizard on the Fortigate. 

On the client side, the configuration has also been done. 

When I try to establish the connection, the following problem appears : 

- On the client : 

"VPN connection failed. Please check your configuration, network connection and pre-shared key then retry your connection. 

If the problem persists, contact your network administrator for help"

-On the fortigate : 

In "Log&Report" > "Event Log" > "VPN" section, I receive two errors (see attached picture VPN.GIF). 

It would be very helpful if anyone could help me making this VPN working :) 

Thanks in advance, 

Cheers. 

Anthony THOMAS. 

[Jeff_FTNT]

config vpn ipsec phase1-interface/edit xxx /set forticlient-enforcement disable/end.

You may paste your setting here, that will be helpful, thanks

[anthony_hgh]

Thanks Jeff. 

Same issue from a computer. 

Below is the asked configuration profil of the PHASE1 : 

name                : HGH_IPSEC 

type                : dynamic 

interface           : VLAN FO Orange 

ip-version          : 4 

ike-version         : 1 

local-gw            : 0.0.0.0

nattraversal        : enable 

keylife             : 86400

authmethod          : psk 

mode                : aggressive 

peertype            : any 

mode-cfg            : enable 

ipv4-wins-server1   : 0.0.0.0

ipv4-wins-server2   : 0.0.0.0

proposal            : aes256-md5 aes256-sha1 aes128-sha256 aes128-sha1 

add-route           : enable 

localid             : 10 

localid-type        : auto 

negotiate-timeout   : 30

fragmentation       : enable 

dpd                 : disable 

forticlient-enforcement: disable 

comments            : VPN: HGH_IPSEC (Created by VPN wizard)

npu-offload         : enable 

--More--          dhgrp               : 14 5 1 

--More--          wizard-type         : custom 

--More--          xauthtype           : auto 

--More--          authusrgrp          : IPSEC_VPN_USERS 

--More--          default-gw          : 0.0.0.0

--More--          default-gw-priority : 0

--More--          assign-ip           : enable 

--More--          mode-cfg-ip-version : 4 

--More--          assign-ip-from      : range 

--More--          ipv4-start-ip       : 192.168.14.100

--More--          ipv4-end-ip         : 192.168.14.200

--More--          ipv4-netmask        : 255.255.240.0

--More--          dns-mode            : auto 

--More--          ipv4-exclude-range:

--More--          ipv4-split-include  : all 

--More--          split-include-service: 

--More--          unity-support       : enable 

--More--          domain              : 

--More--          banner              : 

--More--          include-local-lan   : disable 

--More--          save-password       : disable 

--More--          client-auto-negotiate: disable 

--More--          client-keep-alive   : disable 

--More--          backup-gateway:

--More--          psksecret           : *

--More--          keepalive           : 10

--More--          distance            : 15

--More--          priority            : 0

--More--          xauthexpire         : on-disconnect 

[Jeff_FTNT]

Hi,

I check the setting, the VPN setting is created by VPN wizard (wizard-type  :custom ), normally it have " wizard-type dialup-forticlient". I create one with " wizard-type dialup-forticlient", it is works for me.Thanks.

[Adrian]

Since you're actually using the FortiClient, why not use SSL VPN instead of IPsec ? Also, if your client is actually an iOS or OS X device, you wouldn't even need the Forticleint since the OS has built in support for Cisco style client IPsec VPN.

[Sunil_Panchal_NSE7]

Dear all,

    i have a strange problem regarding IPSEC VPN connection ,

i have 140D with 5.4 OS running.

i have created a IPSEC VPN connection for remote user but the problem is that .

i am not able to connect vpn from my local wire(FastTelco in Kuwait) internet

but i have another mobile internet 4G (Ooredo) for which vpn is working fine with any error

when i saw log for cable connection it show DPD error so i disable it and it work for first time then when i want to connection with same cable internet it not connecting or show username ,password or preshared key is wrong.

i dont know that is the problem , our ISP is saying there is no problem from there side.

but from another internet 4G vpn is working like charm.

can you suggest me what is the problem because we are going to deploy site to site VPN from our company to our remote site 

this can cause big trouble to us.

thanks

[Jeff_FTNT]

Hi superindian,

When test with local wire case, make sure phase1-interface have correct binding interface and correct routes. Thanks.

[Stanislav_Pshebylsky]

I have the same problem with Windows 7 Pro (latest updates) and my new Fortigate 100D, upgradet up to 5.4 b1011...

[ntsele]

I have the same problem; both SSL and IPSec are not connecting. I want to use SSL for the remote access to our server farm and IPSec for mobile phones' connection.