only one VPN client can establish connection at one time

[#1]

We are currently using the Kerio Firewall 6.x to connect to the remote site using the Fortigate 100A. However, only one VPN client (forticlient v1.2.04) can connect to the VPN gateway at one time. The other workstation will fail to established the VPN connection. We set the outbound rule as follows for the VPN connection: Sources Destination Services allow Translation ------------- --------------- ------------------------ ----------------- internal IPs VPN gateway UDP 500, UDP 4500 NAT to WAN IP In the Fortigate 100A VPN gateway, we set the encryption rule with dial_up VPN gateway and place the rule at the top of the firewall policies. Thx

[#2]

How do you assing IP' s? If your not using DHCP over IPsec, but static address in the VPN client and they are the same, that would explain why only one vpn client can connect at the same time. Regards, Eric

[#3]

We have different IP assigned to each client. In fact, we are able to have multiple clients behind a NETGEAR firewall connected to the VPN. However, we' re having problem with clients behind Kerio WinRoute Firewall. We actually reconfigure our settings on Kerio so that it' s identical to the settings of NETGEAR. Even with that, only one client is allowed to get connected. From the log we saw the Phase 1 was okay. However, the next thing we saw is error message (from client behind Kerio) below: " No response from peer, retransmit [st=1]"

[#4]

Have you tried to make a specific rule in the kerio fw? like allow port 450 etc? Does it work if you disable the Kerio FW? I assume you connect in agressive mode?

[UkWizard]

The problem is the NAT rule, change the outbound rule to just allow traffic through and NOT to nat it to a specific IP/Port. Then the outbound connections will have DIFFERENT source ports and should then work fine. With the rule you have, all clients would be natted behind one port on the firewall, so the returning packets would mostly return to the first machine that was connected. (this is common).

[#6]

Hi UkWizard, I have the same problem as fortigate@hhlmail.com, I have checked NAT option in rule All(internal)->All(external), and disabled Fix Port option. But now only one dialup VPN tunnel can be established, Static VPN tunnel all work fine. Thanks. Harward Gao

[UkWizard]

Explain your setup and problem in more detail.

[#8]

Hi Uk Wizard, We use Fortinet 800, which have set some static ip and dailup IPSEC tunnels. Remote gateway is Draytek vigor 2200E , 2300 or 2900. For 2200E do not support local ID, we use UserID+preshared key instead(refer to Fortinet VPN Guide). All static IP connection work fine, the first dailup connection work fine, but the other dailup connections are failed. The dailup tunnels were set to main mode, remote_dateway=dailup_user group, auth=presharedkey, accept any peer ID. Remote preshared key is set as dailup_user ID+presharedkey(Central Gateway). Firewall policies is created and move to top. By the way, sometimes I found remote gaeway is offline but monitor still show the tunnel is up. Thank you. Regards, Harward Gao

[UkWizard]

So are you saying that you have multiple drayteks connecting to the Fortinet in dialup vpn mode ? Have you got static IP addresses for the drayteks ? The problem could be the fact that you are using the dialup method for multiple site-to-site connections. Dialup configuration is for Client VPNs, not for site-to-site. try using a rule for each and use a DynDNS service for name resolution if the IP addresses are not static. There are free ones out there like dyndns.com

[#10]

Hi UK Wizard, Sure, I have multiple Drayteks connecting to the Fortinet in dialup vpn mode. For agressive mode, Draytek 2200 series route does not support local PeerID configuration.What should I do to setup agressive mode tunnels with it? By the way, dyndns.com often got errors in get ip addresses. Thanks. Regards, Harward Gao