Not applicable
Created on 04-11-2008 07:08 AM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
recover forgotten preshared key
Is there a way to recover a forgotten preshared key for an IPSec VPN connection? I recently updated firmware versions and will need to make changes to the VPN configuration but I can’t remember what preshared key I used.
Nominate a Forum Post for Knowledge Article Creation
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
6 REPLIES 6
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I don' t think there is a way to recover the cleartext key! But there is actually no need for that! You can just save your current config and use the encrypted value from the CLI!
So just make your changes and paste your old encrypted value to your new config:
config vpn ipsec phase1 (or phase1-interface)
edit " YourTunnelName"
set psksecret ENC whateverencryptedsecret
next
end
cheers.roman
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are a couple ways around this.
The easiest of which is to just change both ends.
If that is not available, save the IPSEC phase 1 data from the backup.
Config vpn ipsec phase1[-interface] edit " phase 1 name" set interface " wan1" set dhgrp 1 set proposal des-md5 set remote-gw xxx.xxx.xxx.xxx set psksecret ENC xxxxxxxxx <--- This is the line you need endCreate the tunnel using a bogus pre shared key. When the whole thing is built, paste it back in. Good luck
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
Bob - self proclaimed posting junkie!See my Fortigate related scripts
at: http://fortigate.camerabob.com
Not applicable
Created on 04-11-2008 08:58 AM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Guys,
I copied and saved that psksecret ENC value and will implement when I attempt the update again.
As long as we’re one this subject can I pick your brains a bit?
I updated firmware versions yesterday from v2.80 MR5 to v2.8 MR11 and tested everything okay.
When going from v2.80 MR11 to v3.0 MR6 all worked okay except for the VPN connections wouldn’t connect. My original connection name is ‘test’ but during the update an additional connection called test02 (I believe it was) was created. I’m connected to the WAN2 interface (WAN1 is not used) and if I’m not mistaken one of the connections defaulted to the WAN1 interface. The firewall policy for the connection was unchanged.
The local users and the users group seemed to be okay. What is different between 2.80 and 3.0 that would give me problems? Don’t have a very good understanding of how the VPN works anyway. I needed tech support when setting up initially.
I moved it back to v2.80 MR11 after many failed attempts at reconfiguring so that remote users could work today.
Any though and/or suggestions would be greatly appreciated.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Upgrading from 2.8 to 3.0 MR6 is not supported!! I think the problem might be there!
From the release notes:
Upgrade to FortiOS v2.80 MR11 prior to upgrading to FortiOS v3.00 MR5....
... and then to MR6!!!
So best thing would be having a look into the release notes, there are also some issues described regarding the upgrades!!
cheers.roman
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Another thing that happened somewhere during the many upgrades is with SSL VPN policies, the source has to be ' all' . In older versions, you could narrow that down. After MR3 (I believe) that stopped. This doesn' t affect you...yet.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
Bob - self proclaimed posting junkie!See my Fortigate related scripts
at: http://fortigate.camerabob.com
Not applicable
Created on 04-16-2008 08:28 AM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the input, It turned out that my older version of FortiClient wasn' t compatible with v3.0.