Windows IPSec failing

[jdsauer77]

I am running into an issue with both the FortiClient and the Windows Native VPN, and not sure what is happening. I created the tunnel via the IPSec Wizard for a Windows 11 device. I chose Windows Native, configured the pre-shared key, set my user via LDAP, all the fun stuff you would do.

For some reason, when trying to connect, it is telling me that the preshared key is invalid, even though I have typed it, copied and pasted it, etc. to get past phase 1. The PC in question is a Copilot+ PC, so it's running ARM64. I found that there is a new FortiClient for ARM64, so I removed the Windows Native configuration and setup a new one using the FortiClient option for the tunnel. Still, I am getting the same error with trying to authenticate.

Relevant Configuration for the WinVPN setup I have:

IPSec Config:

show vpn ipsec phase1
config vpn ipsec phase1
end

show vpn ipsec phase1-interface
config vpn ipsec phase1-interface
edit "WinVPN"
set type dynamic
set interface "wan1"
set peertype any
set net-device disable
set proposal aes256-md5 3des-sha1 aes192-sha1
set comments "VPN: WinVPN (Created by VPN wizard)"
set dhgrp 2
set xauthtype auto
set authusrgrp "tsfvpn"
set psksecret ENC <key goes here>
next
end

Policy Config:

edit 5
set name "WinVPN-EXT-L2TP"
set uuid 11f6ae04-ba03-51ef-5a4d-fbedc25c10df
set srcintf "WinVPN"
set dstintf "wan1"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "L2TP"
set logtraffic all
set comments "VPN: WinVPN (Created by VPN wizard)"
next
edit 6
set name "VPN-IN-All"
set uuid 12005fee-ba03-51ef-c24c-a1f6276341e1
set srcintf "l2t.root"
set dstintf "internal"
set action accept
set srcaddr "WinVPN_range"
set dstaddr "LAN"
set schedule "always"
set service "ALL"
set logtraffic all
set nat enable
set comments "VPN: WinVPN (Created by VPN wizard)"
next
edit 7
set name "VPN-OUT-All"
set uuid e8397442-ba03-51ef-cb51-9d387ba014de
set srcintf "l2t.root"
set dstintf "wan1"
set action accept
set srcaddr "WinVPN_range"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all
set nat enable
next

What's funny is that I had this working without issue on my previous laptop, but when I got this one and configured it, I started getting errors. The Windows configuration was done according to the guides, including changing the authentication to PAP, instead of MSCHAP/MSCHAP2.

Any idea what could be going on?

[jdsauer77]

I haven't re-tried using the FortiClient yet, as I know this configuration was working in the past. However, if someone has a decent guide on how to configure both sides (there doesn't seem to be much for the FortiClient side when using LDAP properly, which is where my connection was failing when I tried it previously), I'd be happy to follow a guide.

[jdsauer77]

Just tried FortiClient using 2 different internet connections and all I'm getting is that the connection timed out. I tried exporting the "Debug" logs and all it tells me is that the GUI started.... What's the point of Debug Logs if they don't give me any info?