vpnipsec phase2

[psir]

hello,

i have problem with my vpn ipsec 

i tried to connect to vpn but i have error during phase 2 

and on wireshark 

i'm stuck at here

same on forticlient log,  i have no idea why

config :

same auth-encryption for vpn settings and client 

good selectors for phase 2 ( src and dest addresses  )

why quick mode failed ? 

i can share log from CLI 

thanks 

[funkylicious]

hi,

some logs would help

[psir]

thanks for your repply @funkylicious 

see logs , i just hide some ip  :

ike V=root:0: comes x.x.x.x:500->xxxxxx:500,ifindex=17,vrf=0,len=572....
ike V=root:0: IKEv1 exchange=Aggressive id=ac4e19fe3023317d/0000000000000000 len=572 vrf=0
ike 0: in AC4E19FE3023317D000000000000000001100400000000000000023C04000064000000010000000100000058010100020300002801010000800B0001000C00040001518080010
007800E008080030001800200018004000E0000002802010000800B0001000C00040001518080010007800E010080030001800200048004000E0A0001045D953284DDC2E84FADC5A883C0F4
84961050A7F03EA46A882B94E94124A7554CF89766395F17B3FD5214236C5770751EF4C60DC2892AF00CE5C350F987EE7670ED03938414FF0192290331715A95CD4679F6650BDAF6E95F89F
4070CDFAB862176453B6894F714C0CD56D77938AE7C876006E3F0FAE8C0BD9EB3899958DF5861F68E5C4FAAF8A17134DF6C57C98D89ED268A92909101AB84A1D0E4D4941C4E5BE5CD06327F
0573DA00A4D95FF6F30B81B03C8F8D2B51258514CB7D2C2E229CBC052F9ECCE7A12F0146A1C5964AF2E333CD7AE14367C55BFAF98314D830E3239D4CF32E16C315BBAF92B6AAA80BF1D9DCA
2C8C7492B0E8C32F190DB6C3CB2685105000014E19BFED6FAC6C6DE47D0FF4AEC6749910D00000C010000009F54224B0D00001412F5F28C457168A9702D9FE274CC01000D0000144A131C81
070358455C5728F20E95452F0D000014CD60464335DF21F87CFDB2FC68B6A4480D00001490CB80913EBB696E086381B5EC427B1F0D00000C09002689DFD6B7120D000014AFCAD

[funkylicious]

i assume that you are using the VPN Only version of FortiClient and not one managed by a EMS.

if so, https://docs.fortinet.com/document/fortigate/7.6.1/administration-guide/710480 try disabling ems-sn-check, which is enabled by default starting with 7.6 

as for phase-2 selectors, i would leave the default ones for src and dst 0.0.0.0/0

L.E. https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-dial-up-full-tunnel-with-FortiClient...

[psir]

when i disable ems check  i have new logs

ike V=root:0: comes x:500->y:500,ifindex=17,vrf=0,len=572....
ike V=root:0: IKEv1 exchange=Aggressive id=62a2b101026465ac/0000000000000000 len=572 vrf=0
ike 0: in 62A2B101026465AC000000000000000001100400000000000000023C04000064000000010000000100000058010100020300002801010000800B0001000C000400015180
ike V=root:0:vpn4_0:116: mode-cfg type 4 request 0:''
ike V=root:0:vpn4_0:116: mode-cfg WINS ignored, no WINS servers configured
ike V=root:0:vpn4_0:116: mode-cfg type 13 request 0:''
ike V=root:0:vpn4_0:116: mode-cfg type 8 request 0:''
ike V=root:0:vpn4_0: IPv6 pool is not configured
ike V=root:0:vpn4_0:116: mode-cfg could not allocate IPv6 address
ike V=root:0:vpn4_0:116: mode-cfg type 9 request 0:''
ike V=root:0:vpn4_0:116: mode-cfg type 10 request 0:''
ike V=root:0:vpn4_0:116: mode-cfg type 11 request 0:''
ike V=root:0:vpn4_0:116: mode-cfg type 11 not supported, ignoring
ike V=root:0:vpn4_0:116: mode-cfg type 15 request 0:''
ike V=root:0:vpn4_0:116: mode-cfg type 25 request 0:''
ike V=root:0:vpn4_0:116: mode-cfg type 28672 request 0:''
ike V=root:0:vpn4_0:116: mode-cfg UNITY type 28672 requested
ike V=root:0:vpn4_0:116: mode-cfg no banner configured, ignoring
ike V=root:0:vpn4_0:116: mode-cfg type 28674 request 0:''
ike V=root:0:vpn4_0:116: mode-cfg UNITY type 28674 requested
ike V=root:0:vpn4_0:116: mode-cfg no domain configured, ignoring
ike V=root:0:vpn4_0:116: mode-cfg type 28675 request 0:''
ike V=root:0:vpn4_0:116: mode-cfg UNITY type 28675 requested
ike V=root:0:vpn4_0:116: mode-cfg UNITY type 28675 not supported, ignoring
ike V=root:0:vpn4_0:116: mode-cfg type 28678 request 0:''
ike V=root:0:vpn4_0:116: mode-cfg UNITY type 28678 requested
ike V=root:0:vpn4_0:116: mode-cfg type 28673 request 0:''
ike V=root:0:vpn4_0:116: mode-cfg UNITY type 28673 requested
ike V=root:0:vpn4_0:116: mode-cfg type 21514 requested
ike V=root:0:vpn4_0:116: mode-cfg type 21515 requested
ike V=root:0:vpn4_0:116: mode-cfg type 7 request 0:''
ike V=root:0:vpn4_0:116: mode-cfg assigned (1) IPv4 address 10.10.10.1
ike V=root:0:vpn4_0:116: mode-cfg assigned (2) IPv4 netmask 255.255.255.248
ike V=root:0:vpn4_0:116: mode-cfg send (13) 0:0.0.0.0/0.0.0.0:0
ike V=root:0:vpn4_0:116: mode-cfg send (3) IPv4 DNS(1) xxx
ike V=root:0:vpn4_0:116: mode-cfg send (3) IPv4 DNS(2) xxx
ike V=root:0:vpn4_0:116: mode-cfg assigned (9) IPv6 prefix 128 netmask ffffffffffffffffffffffffffffffff
ike V=root:0:vpn4_0:116: mode-cfg send INTERNAL_IP6_SUBNET
ike V=root:0:vpn4_0:116: mode-cfg IPv6 DNS ignored, no IPv6 DNS servers found
ike V=root:0:vpn4_0:116: mode-cfg send APPLICATION_VERSION 'FortiGate-201E v7.6.3,build3510,250415 (GA.F)'
ike V=root:0:vpn4_0:116: mode-cfg send (28673) UNITY_SAVE_PASSWD
ike V=root:0:vpn4_0:116: client auto-negotiate is disabled
ike V=root:0:vpn4_0:116: client-keep-alive is disabled
ike 0:vpn4_0:116: enc 62A2B101026465ACA2262125D199071408100601B1AE0E94000000C20E000014D2E99EA46786D435AF78760A94C78C290000009202002BC1000100040A0A0A0100020004FFFFFFF8000D0008000000000000000000030004602D2D2D00030004602D2E2E00090010FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000F001100000000000000000000000000000000000007002D466F727469476174652D323031452076372E362E332C6275696C64333531302C323530343135202847412E4629F0010001
ike 0:vpn4_0:116: out 62A2B101026465ACA2262125D199071408100601B1AE0E94000000CC49B71A405ADDA49538A85397F29AF6114E53ADE8BB4A6385D9EA5FAE8E277E7FEFA84354C8207994D9D3A521348CC77E0F625C29784C69006E1AD5A45783ABE5BEDA627040239A946F0478010FC8B72C4230418C18ABA034C77DF911364F7CE2B0A259881C62B56FE4B06864E9399CDE47942E4A06251972ED61D84D152DE78C32566FDF6A490FAF939DA91A3DE902B84CC317154F5B79F24A38E44EFF4161DB414E6A3F0E85FE57D329393FA437A460
ike V=root:0:vpn4_0:116: sent IKE msg (cfg_send): x:500->y:500, len=204, vrf=0, id=62a2b101026465ac/a2262125d1990714:b1ae0e94

but not error for phase 2 

any idea ? 

thanks :) 

[funkylicious]

can you share the configuration for both phase1 and phase2 from cli or gui ( w/o sensitive information like public ip and psk ) ?

as for phase-2, try leaving it at the default values of 0.0.0.0/0 if not already since you mentioned in the first post that they are correct - by that i would suspect that you have changed them.

is it split-tunnel or a full-tunnel setup and are you using XAUTH for with/a specific peer id in phase-1 ?

[psir]

i tested split and full,

any id not spcecific

thanks

[funkylicious]

if i'm not mistaken, under phase2 if you edit/expand vpn4 you should also have PFS enabled and DH ( which i know are by default in older version, i don't have access to a device with 7.6.X to see how they are by default ), which in your FCT config are missing.

please have a look at that that confirm this suspicion.

in the firewall rules, i guess you already have srcintf vpn4 > dstintf INTF-X and srcaddr the range that would be allocated to you, without the group.

[psir]

PFS are disabled both in fct config and forti config 

yeah already have rule :) 

[funkylicious]

in this case, the configuration seems to match for phase1 and phase2.

it's kinda strange why it would not connect. i feel like some logs in regards to phase2 and why it's not coming up are somewhere in there.

this as a side note, i had plenty of issues where the client would not connect, although everything was in order. this was resolved by deleting the IPsec VPN config in FortiClient and redoing it and then it worked, maybe try this also.