VPN connection failure

[Polybag]

I recently upgraded my computer to Windows 11 and since then my VPN has not worked. I uninstalled the previous version and upgraded to the latest, to no avail.

I see it trying the connection on the Fortigate, but that's it.

Below is the client log.

11/26/2022 9:31:00 PM info ipsecvpn date=2022-11-26 time=21:30:59 logver=1 id=96566 type=securityevent subtype=ipsecvpn eventtype=status level=info uid=473E35B610DE464ABDxx5E9F5149E34C devid=FCT8003212200810 hostname=XXXXX pcdomain=N/A deviceip=192.168.0.41 devicemac=b0-XX-7a-72-XX-XX site=N/A fctver=7.0.7.0345 fgtserial=FCT8003212200810 emsserial=N/A os="Microsoft Windows 11 Professional Edition, 64-bit (build 22621)" user=Bryan msg="loc_ip=192.168.0.41 loc_port=500 rem_ip=00.000.00.165 rem_port=500 out_if=0 vpn_tunnel=REPLACED action=negotiate init=local mode=aggressive stage=1 dir=outbound status=success Initiator: sent 00.000.160.165 aggressive mode message #1 (OK)" vpntunnel=REPLACED
11/26/2022 9:31:12 PM warning ipsecvpn date=2022-11-26 time=21:31:11 logver=1 id=96561 type=securityevent subtype=ipsecvpn eventtype=error level=warning uid=473E35B610DE464ABD285E9F5149E34C devid=FCT8003212200810 hostname=XXXXX pcdomain=N/A deviceip=192.168.0.41 devicemac=XX-XX-XX-XX-XX-XX site=N/A fctver=7.0.7.0345 fgtserial=FCT8003212200810 emsserial=N/A os="Microsoft Windows 11 Professional Edition, 64-bit (build 22621)" user=Bryan msg="No response from the peer, phase1 retransmit reaches maximum count" vpntunnel=REPLACED locip=192.168.0.41 locport=500 remip=00.000.160.165 remport=500

I don't know what to do beyond this so any help would be appreciated.

[msolanki]

Hi Polybag,

With the logs error msg="No response from the peer, phase1 retransmit reaches maximum count" not exactly identify the what causing issue but "Generally these errors occur when there are blocks from the ISP or the remote port 500 which is used to exchange the messages to establish the tunnel. The error may be that the remote device is not receiving these messages or that it receives them, responds to them, but the response does not reach its FortiGate."
So, can you check remote port 500 in your environment and with your ISP? 

Or just debug vpn to know more about it.

Thanks

Madhav

[Polybag]

Thanks for the reply. I did try a few things that seem like good troubleshooting steps.

First I disabled windows firewall on the affected laptop, that didnt work. I am not seeing anything in the firewall about that port though, but disabling should have worked.

Next I disabled the antivirus on the laptop and that didnt work either.

If I try another laptop from the same location, it works.

I also tried backing up the config from the good laptop and importing it into the bad one and still nothing.

I can see it hit the Fortigate for the first step, but then it deletes phase 1 and doesnt do anything else.

Anything else I can supply you to help?

[anikolov]

Hello Polybag,

You can also try to check if host-check is enabled on the fortigate, try for troubleshoot purposes to disable to check if you can connect.

Regards,

[freber]

We get the same error message on new Windows 11 machines, does anyone have a solution for this!?

[Quint021]

Hello @freber,

To confirm, Windows 10 works but not Windows 11?

From your statement where traffic reaches the fortigate but no response, can you collect the IKE debugs to determine how FortiGate is processing the packets?

Reference: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPSEC-Tunnel-debugging-IKE/ta-p/1900...

Kind Regards,

[freber]

Yes it works in Win 10 but not 11.

We have several VPN connections running right now.

How do I collect the logs according to the reference?

I just get this when running the first command:

# diag vpn ike log-filter name "vpntunnel"

command parse error before 'log-filter'
Command fail. Return code -61

[Quint021]

Hello @freber<,

Here are the commands to collect:
diagnose debug disable 
diagnose debug reset 
diagnose debug application ike -1
diagnose debug console timestamp en 
diagnose debug enable 

*Attempt to connect to the VPN*

Please take note of the Public IP address from which you are connecting to the VPN as well as the timestamp of the connection as that will aid the investigation. Try connecting a few times as well after enabling the debugs.

To disable the debugs after, run the following:
diagnose debug disable 
diagnose debug reset 

Kind Regards,

[freber]

Can I share the result with you privately?

[freber]

I have collected all the logs.