getting Invalid Length of Value when trying to select a Firewall group in IKEV2 IPsec settings

[ForgetItNet]

Hi all,

I'm trying to move away from the SSL VPNs we have and setup IPSec and if i use the basic wizard this all works but it then defaults to IKEV1 so i set it as a custom tunnel and selected IKEV2 but when i then change the "accept types" to Peer ID from Dialup Group and then select the same group we use in the SSL config i then get "invalid length of value" ? There doesn't seem to be much information on this that i can find apart from a few posts saying the group has to be either setup locally or of the type "firewall" which this is ? 

If i choose IKEV1 and use XAUTH then it accepts the group without any issue.

any help would be great.

Thanks

[ForgetItNet]

Also to add that if I create a new group with a local user in it then it doesn't show the error and allows me to select it but then Phase1 completes but I get an error stating "no response from peer" and no Phase 2 is even started. We've got a FortiGate Analyser and that also just shows the Phase1 connecting successfully but nothing is in there about Phase 2 but again if I set it to allow ANY peer and turn EAP off on the FortClient (so there's no username or password) then it works fine and connects ?

[yderek]

@ForgetItNet  What kind of the user group you are using in SSL that giving you error when you apply to IKEv2 ? Is that SAML group or LDAP group ?

[ForgetItNet]

Hi Yderek, so I'm not 100% in what it classes as so we have a local group of users that we add people to for access to the VPN but we add people to this from an LDAP integration i.e we can search LDAP, right click the person and then get the option to add them and they then show up in the local list.

[yderek]

Please also upload the group screenshot to here or using command  'show user group ' 

[ForgetItNet]

This is a T

This is a screenshot of that "show user group" command, i've redacted a lot as it's got usernames etc in obviously but there are just the 3 groups.

[ForgetItNet]

I've managed to get this going (sort of)....i removed the IPsec VPN and then set it up again with this guide:

IKEv2 Dialup IPsec tunnel with Radius and... - Fortinet Community

It does involve setting up a Radius server and then creating a new group on the Fortgate but setting the users up as Radius users as opposed to LDAP one's but i can enable 2FA on there and it connects with EAS256-SHA256 and DH20 so it's secure....i just need to play around with the users and groups again but i think this should sort it.