VPN L2TP/IPSEC doesn' t work with Android Phone

[#1]

Hi All, I configured my Fortinet FGT-200A for the VPN L2TP/IPSEC connection but these don' t work. I verified the failure of the vpn connection with Android phones while the connections with Apple Iphone works correctly. I tested the following FortiOS versions with this results: 1) FortiOS MR2 Patch 2 (Apple Iphone and Android doesn' t works) 2) FortiOS MR2 Patch 8 (Apple Iphone work correctly while Android phone doesn' t work) 3) FortiOS MR3 Parch1 (Apple Iphone work correctly while Android phone doesn' t work) I have carried out the tests with the following software versions of mobile phones: Apple Iphone 4.3.3 Android 2.3.3 Gingerbread (Samsung Galaxy S) the configuration is identical to the example found in the following guide: FortiGate-ipsec-40-mr2.pdf from my analysis of the problem may be this: 2011-08-17 11:49:22 ike 0:l2tp-ipsec_0:8:35: peer proposal is: peer:17:217.203.xxx.xxx-217.203.xxx.xxx:0, me:17:213.xxx.xxx.xxx-213.xxx.xxx.xxx:1701 2011-08-17 11:49:22 ike 0:l2tp-ipsec_0:8:L2TP:35: trying 2011-08-17 11:49:22 ike 0:l2tp-ipsec_0:8:35: assume missing NAT-OA is 17:217.203.xxx.xxx-217.203.xxx.xxx:0 2011-08-17 11:49:22 ike 0:l2tp-ipsec_0:8:35: transport mode, override with 17:172.16.xxx.xxx-172.16.xxx.xxx:1701 -> 17:217.203.xxx.xxx-217.203.xxx.xxx:0 2011-08-17 11:49:22 ike 0:l2tp-ipsec_0:8:L2TP:35: IPsec SA selectors #src=1 #dst=1 2011-08-17 11:49:22 ike 0:l2tp-ipsec_0:8:L2TP:35: src 0 7 17:172.16.xxx.xxx-172.16.xxx.xxx:1701 2011-08-17 11:49:22 ike 0:l2tp-ipsec_0:8:L2TP:35: dst 0 7 17:217.203.xxx.xxx-217.203.xxx.xxx:0 during the negotiations for the encryption domain the peer proposes the ip address with port 0 while from iphone debug file the peer proposes the ip address with random udp port, I believe that for this reason the L2TP phase doesn' t start when the Android phone trying to connect. I forgot to tell you that my VPN firewall has an private ip address with NAT through another firewall connected to internet. Has anyone tried this configuration? It could be a bug? Regards, Aldino

[ede_pfau]

Hi, and welcome to the forums. Without deeper knowledge of Android, this is what I stumbled upon:

 2011-08-17 11:49:22 ike 0:l2tp-ipsec_0:8:35: peer proposal is:
 peer:17:217.203.xxx.xxx-217.203.xxx.xxx:0, 
   me:17:213.xxx.xxx.xxx-213.xxx.xxx.xxx:1701

Looks like each side talks about different IP range, in the Quick Mode selector.

[#3]

Hi ede_pfau, and thank you for welcome. this IP 217.203.xxx.xxx/32 is Android Client and this IP 213.xxx.xxx.xxx/32 is Firewall IP address on Internet. The Quick Mode Selector is configured with 0.0.0.0/0 and port/protocol 0, so the client and VPN Firewall negotiate these parameters during the IPSEC phase2. I tried to force these parameters but the IPSEC phase2 fails. Have you other ideas? Aldino

[ede_pfau]

No, sorry, mainly due to lack of mobile device and/or L2TP usage.