Win. Native Rem. Acc. throug L2TP-IPSec VPN from Windows 10 to FGT60E behind DSL router

[InventX]

I use the Fortigate60E as firewall and router behind a DSL modem. The FGT is connected to the DMZ port of the DSL modem (FritzBox 7360). I'm able to log in to the FritzBox on port 442, and the management port of the FGT is HTTPS: 444. I'm also able to login to the FGT from a remote desktop. The Physical settup is: Internet (public IP) <--> Frtizbox (192.168.1.1) <-->  (192.168.1.20) Fortigate 60E <--> (192.168.2.1/24) Lan Clients. The Lan Clients is on port 2 (as Interface, not as LAN port).

port 2 (internal1) has static IP adress 192.168.2.1 with DHCP Server (s.i.p: 192.168.2.10, e.i.p: 192.168.2.254) no Secondary IP Address. The wan1 interface has addressing mode: DHCP (from FritzBox, which assigns static IP address: 192.168.1.20) with Acquired DNS 192.168.1.1 and Default Gateway: 192.168.1.1 (= FritzBox LAN port 1). Retrieve default gateway from server is on and Override internal DNS is also on.

I'm also able to port forward VOIP settings to a local PBX server and WebDav ports to a NAS in the local network. When I create a IPSec tunnel with the IPSec Wizard and choose for Remote Access and Windows Native, and fill in all settings:

2) Incoming Interface: Wan1 (192.168.1.20), Pre-shared key, User Group (VPN-Users)

3) Local interface: Lan-Clients (192.168.2.1/24), Local Address: all, Client Address Range: 10.10.100.1-10.10.100.100, Subnet Mask: 255.255.255.255

When I try to connect from remote Client I see the tunnel is coming up, but the VPN Events only are showing negotiate failures on the IPSec phase 1 connector.

What should I do to make this work?? I've spend days searching the Forti Cookbook and forums and Youtube video's, but it won't work..

Please help!

[InventX]

Hi Jining,

Than I think that'll be the issue. If the FGT is connected to the Internet direct, we've no problem, If connected to DSL router (as an exposed host, so all ports will be forwarded to FGT), we have to deal with the double NAT problem.

I've attached a log file when trying to connect with the L2TP-IPSec vpn to the FGT.

Hope you can see someting in it?

Thanks alot!

[InventX]

How can I log the packet capture files for both ports?

[InventX]

One more update:

Setting up a PPTP connection isn't a problem. Also a SSL-VPN connection isn't a problem, only the L2TP-IPSec vpn connection is a problem.

I have to little knowledge of VPN protocols to choose between these 3 protocols. After searching many days on the internet I find the IPSec (over L2TP) protocol should be the fastest one and maybe also the most secure one?

Again thanks for the support!

[InventX]

Attached is a screenshot of the sniffer running at ports 500 and 4500, while trying to connect with the IPSec VPN tunnel.

[rwpatterson]

Try changing the near end selector (network) to the public IP of the DSL box.

[InventX]

Hello Bob, 

Thank you for your reply! 

I'm just a starter with Fortinet, and don't understand well what you mean... Can you please explain a bit more what you mean by changing the near end selector? How should I do that?

Thank you.

[jnliu_FTNT]

Hi Leander,

From you debug, we can see ISAKMP SA negotiation failure.

Would you post the following FGT config?

show vpn ipsec phase1-interface

show vpn ipsec phase2-interface

show vpn l2tp

[InventX]

This is the VPN IPsec config right now..

[jnliu_FTNT]

Hi Leander,

Thanks for your config.

It looks like phase1 proposal and dh group doesn't match the incoming one.

I suggest you add the following proposal to phase1 and phase2 config and change phase1 dhgrp to 5.

  3des-sha256 aes128-sha256 aes192-sha256

Regards,

Jining

[InventX]

Hi Jining,

It looks like you've helped me one step further!!

First I got a Phase1 negotiation error (see attached file), with the dhgrp set to 5 now phase 1 isn't giving a problem. But now I get a negotiation error on phase 2. I'll post that picture in the next post.

Hope that can be solved also...

Thank you!