recover forgotten preshared key

[#1]

Is there a way to recover a forgotten preshared key for an IPSec VPN connection? I recently updated firmware versions and will need to make changes to the VPN configuration but I can’t remember what preshared key I used.

[romanr]

Hi, I don' t think there is a way to recover the cleartext key! But there is actually no need for that! You can just save your current config and use the encrypted value from the CLI! So just make your changes and paste your old encrypted value to your new config: config vpn ipsec phase1 (or phase1-interface) edit " YourTunnelName" set psksecret ENC whateverencryptedsecret next end cheers.roman

[rwpatterson]

There are a couple ways around this. The easiest of which is to just change both ends. If that is not available, save the IPSEC phase 1 data from the backup.

 Config vpn ipsec phase1[-interface]
     edit " phase 1 name" 
         set interface " wan1" 
         set dhgrp 1
         set proposal des-md5
         set remote-gw xxx.xxx.xxx.xxx
         set psksecret ENC xxxxxxxxx <--- This is the line you need
         end

Create the tunnel using a bogus pre shared key. When the whole thing is built, paste it back in. Good luck

[#4]

Thanks Guys, I copied and saved that psksecret ENC value and will implement when I attempt the update again. As long as we’re one this subject can I pick your brains a bit? I updated firmware versions yesterday from v2.80 MR5 to v2.8 MR11 and tested everything okay. When going from v2.80 MR11 to v3.0 MR6 all worked okay except for the VPN connections wouldn’t connect. My original connection name is ‘test’ but during the update an additional connection called test02 (I believe it was) was created. I’m connected to the WAN2 interface (WAN1 is not used) and if I’m not mistaken one of the connections defaulted to the WAN1 interface. The firewall policy for the connection was unchanged. The local users and the users group seemed to be okay. What is different between 2.80 and 3.0 that would give me problems? Don’t have a very good understanding of how the VPN works anyway. I needed tech support when setting up initially. I moved it back to v2.80 MR11 after many failed attempts at reconfiguring so that remote users could work today. Any though and/or suggestions would be greatly appreciated.

[romanr]

Upgrading from 2.8 to 3.0 MR6 is not supported!! I think the problem might be there! From the release notes: Upgrade to FortiOS v2.80 MR11 prior to upgrading to FortiOS v3.00 MR5.... ... and then to MR6!!! So best thing would be having a look into the release notes, there are also some issues described regarding the upgrades!! cheers.roman

[rwpatterson]

Another thing that happened somewhere during the many upgrades is with SSL VPN policies, the source has to be ' all' . In older versions, you could narrow that down. After MR3 (I believe) that stopped. This doesn' t affect you...yet.

[#7]

Thanks for the input, It turned out that my older version of FortiClient wasn' t compatible with v3.0.