fortigate 60E ipsec tunnel issue

[kkbk96]

Trying to bring up VPN from the forticlient on my phone to the firewall which is on version 7.2.0. Phase 1 shows success and thats it.

Logs below, shows timeout so no idea whats happening:

ike 0: comes 172.x.x.x:26655->173.x.x.x:500,ifindex=5,vrf=0....

ike 0: IKEv1 exchange=Aggressive id=aaad59c925e55457/0000000000000000 len=572 vrf=0

ike 0: in AAAD59C925E55457000000000000000001100400000000000000023C0400009C000000010000000100000090010100040300002401010000800B0001800C708080010007800E00808003000180020002800400050300002402010000800B0001800C708080010007800E00808003000180020001800400050300002003010000800B0001800C7080800100058003000180020002800400050000002004010000800B0001800C7080800100058003000180020001800400050A0000C40411150C4FDE77C7991600F89A104FB26D1C628FA46398683E32BFAD3070AF3340D665B465372E86C7AFF0F85D555A14B0E686DCFA45F8F314106DB76E41461030BE808BDE15AF3B62F0E47BFE504C96A030432EB60918E2005CE0F50B74D3DDC7F39E689F690331EF5B0284CD9DF4CC6665B43D648938E4B62CD74E98AD36B0C9CFE444431A9D33BDEA628A36B6353B5DBEEE25606D0E7F3222AA1E7DA5DB9AAB9B17E8894BED24C73DF9D9DA75845B25A86BB9333EB6C1C56E45E2E647DE2B05000014B1DC84B7341BE3A5F078B6439A913A3E0D00000C011105DCC00000020D0000144A131C81070358455C5728F20E95452F0D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D0000144485152D18B6BBCD0BE8A8469579DDCC0D00001412F5F28C457168A9702D9FE274CC01000D000014AFCAD71368A1F1C96B8696FC775701000D0000144C53427B6D465D1B337BB755A37A7FEF00000014B4F01CA951E9DA8D0BAFBBD34AD3044E

ike 0:aaad59c925e55457/0000000000000000:0: responder: aggressive mode get 1st message...

ike 0:aaad59c925e55457/0000000000000000:0: VID RFC 3947 4A131C81070358455C5728F20E95452F

ike 0:aaad59c925e55457/0000000000000000:0: VID draft-ietf-ipsec-nat-t-ike-02 CD60464335DF21F87CFDB2FC68B6A448

ike 0:aaad59c925e55457/0000000000000000:0: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913EBB696E086381B5EC427B1F

ike 0:aaad59c925e55457/0000000000000000:0: VID draft-ietf-ipsec-nat-t-ike-00 4485152D18B6BBCD0BE8A8469579DDCC

ike 0:aaad59c925e55457/0000000000000000:0: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100

ike 0:aaad59c925e55457/0000000000000000:0: VID DPD AFCAD71368A1F1C96B8696FC77570100

ike 0:aaad59c925e55457/0000000000000000:0: VID forticlient connect license 4C53427B6D465D1B337BB755A37A7FEF

ike 0:aaad59c925e55457/0000000000000000:0: VID Fortinet Endpoint Control B4F01CA951E9DA8D0BAFBBD34AD3044E

ike 0::0: peer identifier IPV4_ADDR 192.0.0.2

ike 0: cache rebuild start

ike 0:RemoteAccOuts: cached as dynamic

ike 0: cache rebuild done

ike 0: IKEv1 Aggressive, comes 172.x.x.x:26655->173.x.x.x 5

ike 0:aaad59c925e55457/0000000000000000:0: negotiation result

ike 0:aaad59c925e55457/0000000000000000:0: proposal id = 1:

ike 0:aaad59c925e55457/0000000000000000:0: protocol id = ISAKMP:

ike 0:aaad59c925e55457/0000000000000000:0: trans_id = KEY_IKE.

ike 0:aaad59c925e55457/0000000000000000:0: encapsulation = IKE/none

ike 0:aaad59c925e55457/0000000000000000:0: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128

ike 0:aaad59c925e55457/0000000000000000:0: type=OAKLEY_HASH_ALG, val=SHA.

ike 0:aaad59c925e55457/0000000000000000:0: type=AUTH_METHOD, val=PRESHARED_KEY.

ike 0:aaad59c925e55457/0000000000000000:0: type=OAKLEY_GROUP, val=MODP1536.

ike 0:aaad59c925e55457/0000000000000000:0: ISAKMP SA lifetime=86400

ike 0:aaad59c925e55457/0000000000000000:0: SA proposal chosen, matched gateway RemoteAccOuts

ike 0:RemoteAccOuts: created connection: 0x7631148 5 173.x.x.x->172.x.x.x:26655.

ike 0:RemoteAccOuts:0: DPD negotiated

ike 0:RemoteAccOuts:0: peer supports UNITY

ike 0:RemoteAccOuts:0: enable FortiClient license check

ike 0:RemoteAccOuts:0: enable FortiClient endpoint compliance check, use 169.254.1.1

ike 0:RemoteAccOuts:0: selected NAT-T version: RFC 3947

ike 0:RemoteAccOuts:0: generate DH public value request queued

ike 0:RemoteAccOuts:0: compute DH shared secret request queued

ike 0:RemoteAccOuts:0: cookie aaad59c925e55457/60eea0a873701dae

ike 0:RemoteAccOuts:0: ISAKMP SA aaad59c925e55457/60eea0a873701dae key 16:EFA920DB7F8B6F1FC34B32EA19C1353B

ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000

ike 0:RemoteAccOuts:0: sent IKE msg (agg_r1send): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae

ike 0: comes 172.x.x.x:21870->173.x.x.x:4500,ifindex=5,vrf=0....

ike 0: IKEv1 exchange=Informational id=aaad59c925e55457/60eea0a873701dae:99482542 len=92 vrf=0

ike 0: in AAAD59C925E5545760EEA0A873701DAE08100501994825420000005C21D54D2186CCB7DBEACD4AB9F0504F62F49988298A0431E29A4B44FECFE9D047A3650A4FA9C4F7B34610EC46C5166D2648C153AA63B91AD230CD96F33B983E3B

ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000

ike 0:RemoteAccOuts:0: sent IKE msg (P1_RETRANSMIT): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae

ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000

ike 0:RemoteAccOuts:0: sent IKE msg (P1_RETRANSMIT): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae

ike shrank heap by 122880 bytes

ike 0:RemoteAccOuts:0: out AAAD59C925E5545760EEA0A873701DAE0110040000000000000002040400003800000001000000010000002C010100010000002401010000800B0001800C708080010007800E00808003000180020002800400050A0000C46638DF6BDA32F0183025C8973249307B805F671A02F58E0D00FB6113ADCC5814092E02C7B4EA8A1B48812E64AE1D21C8CB299E804B4A301A9BD0E6FDBD583148E14819EBBDD09F3B9682C157BD37A2EADE95C968125E97D21059C9A6F05025EBF605200CCAB66D04AF4656BDDF733F9155A95F0883FCEC1C8D88E818F3EE362FD441C06E5429E5FAB05062DADE07E8CEF5C7E643B3CAA5468B94CA2F0BDA6D58394D2AC71F18D1D3CD79BFF90CAC5DF8EDC333CBBA93E22A4CFA5B5AFF6B05D705000014E2DA6A1BFBDAD40EDF0F8450952A16EE0800000C01000000AD48603A0D000018C6F6ABBDBB7F1B3CD5C28D74B3DC4CF43B6699A9140000144A131C81070358455C5728F20E95452F1400001871D624158DB966560F4635437F0B03052690EEBB0D000018729C5D62B0303484F4AB2C287C97C9E3CFBD67700D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF0D000014B4F01CA951E9DA8D0BAFBBD34AD3044E000000148299031757A36082C6A621DE00000000

ike 0:RemoteAccOuts:0: sent IKE msg (P1_RETRANSMIT): 173.x.x.x:500->172.x.x.x:26655, len=516, vrf=0, id=aaad59c925e55457/60eea0a873701dae

ike 0:RemoteAccOuts:0: negotiation timeout, deleting

ike 0:RemoteAccOuts: connection expiring due to phase1 down

ike 0:RemoteAccOuts: deleting

ike 0:RemoteAccOuts: deleted

172.x.x.x. is my phone ip whereas 173.x.x.x is my fortiagte wan1 ip.

For the ipsec tunnel config where is the phase-2 proposal i dont see it, want to match it with the proposals on the forticlient on my phone, i only see phase-1 proposal not phase-2 when i select the tunnel under ipsec tunnel under VPN.

Logs on fortigate as you can see only shows phase-1

I just tried connecting to the vpn from my laptop (which is on the internal network) to the Fortigate and it worked but if i connect my laptop to say nord vpn so that it can get a public ip and then connect to Fortigate then it doesn't work.

Thank You.

[Anthony_E]

Hello kkbk96,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

[Anthony_E]

Hello,

I have found this KB article which explain how to troubleshoot IPsec VPN tunnels:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Troubleshooting-IPsec-VPNs/ta-p/195955

Could you please tell me if it helps?

Regards,

[kkbk96]

So there is nothing wrong with the tunnel itself, it is up, I just can't get to any network, cannot ping etc when on the vpn. So I don't think this kb is going to be helpful.

[Anthony_E]

Hello,

So we will continue to find a solution and we will come back to you ASAP.

Regards,

[alif]

Hello @kkbk96,

Please share the IPsec VPN configuration of Fortigate and FortiClient.

Please also share the output of the following commands.
show vpn ipsec phase1-interfaceRemoteAccOuts
show vpn ipsec phase2-interface RemoteAccOuts (modify the name if needed)
diag vpn ike gateway list name RemoteAccOuts