Route-based VPN IPsec

[Leandro]

Hello guys, I' m trying to do a IPsec VPN on a Fortigate 60C, the firmware version is v4.0,build5367,101109 (MR2) I have created the Phase 1 and 2, Phase 1 settings: Agressive mode Blank preshared key, Accept peer ID in dialup group " User group" , IKE version 1, Local Gateway IP: Main interface IP P1 proposal: 1 3DES - SHA1 2 AES128 - SHA1 DH Group: 5, Dead Peer Detection. Phase 2 settings: P2 proposal: 1 3DES - SHA1 2 AES128 - SHA1 Enable replay detection Enable perfect foward secrecy (FPS) DH Group 5 Autokey Keep Alive DHCP-IPsec Quick Mode Selector Source address: 0.0.0.0/0 Source port: 0 Destination address: 0.0.0.0/0 Destination port: 0 Protocol: 0 Created 2 firewall rules using the VPN interface pointing to internal and another one from internal to VPN interface. Both rules have: Accept action, No NAT, service ANY; I also created a DHCP server, type IPsec, assinged a free IP range on my internal network, the default gateway is the internal Fortigate interface. The problem is, when I try to connect throught FortiClient I' m not able to, when I check the event log on Fortinet the error message is " IPsec phase 2 error" , the error reason: " no matching gateway for new request" . I' ve also checked the firewall from the client, to see if it is open for IPsec requests. Is this a Phase 2 wrong config? Peer ID problem? To connect I' m using the user a pass that the user have on FortiGate, this user is associated to the user group on the phase 1 config. I appreciate any help.

[ede_pfau]

a) I would not use a blank PSK. Put in something. b) in the quick mode selectors, put your LAN address range into the " destination address" as this is known. c) in the FortiClient setup, put this subnet address into the " destination network" field. The last point makes the Forticlient create a route to the destination.

[Leandro]

Hello ede_pau, thanks for your reply, and sorry for taking so long to reply... I' ve been busy. I followed the steps that you provide but it still not connecting... When I assign the sub-net address for the WAN IP on FortiClient, it shows me a error message that couldn' t find the destination, so I removed, but it still not working. I checked the event log from the fortigate unit and it prompts a error message every time i try to connect it: IPsec phase 2 error ID error: 37125 Reason: no matching gateway for new request. What gateway is that? DHCP gateway?

[Leandro]

I' ve changed the Phase 1 mode to Aggressive and the error on event log has disappeared, but the connection still not work. Checking the debug log I found out that the Phase 1 mode should be " Aggressive" instead of " Main" that' s why I changed. Looking through the debug log I see the information below that repeats a lot, and If I am not wrong this is the DPD checking the connection, but why the connection don' t complete then? I' ve altered the IP' s for security reason 200.200.200.200 - Fortigate WAN IP address 172.16.55.125 - internet client IP address

 ike 0:VPN_1_0:199: sent IKE msg (R-U-THERE): 200.200.200.200:4500->172.16.55.125:4500, len=92
 ike 0: comes 172.16.55.125:4500->200.200.200.200:4500,ifindex=5....
 ike 0: IKEv1 exchange=Informational id=c321f87688c36d32/8da768e25382c548:e866802a len=92
 ike 0: found VPN_1_0 200.200.200.200 5 -> 172.16.55.125:4500
 ike 0:VPN_1_0:199: notify msg received: R-U-THERE-ACK
 ike 0:VPN_1_0: link is idle 5 200.200.200.200->172.16.55.125:4500 dpd=1 seqno=2
 ike 0:VPN_1_0:199: send IKEv1 DPD probe, seqno 2
 ike 0:VPN_1_0:199: confirmed nat-t RFC 3947
 ike 0:VPN_1_0:199: sent IKE msg (R-U-THERE): 200.200.200.200:4500->172.16.55.125:4500, len=92
 ike 0: comes 172.16.55.125:4500->200.200.200.200:4500,ifindex=5....
 ike 0: IKEv1 exchange=Informational id=c321f87688c36d32/8da768e25382c548:d72b0923 len=92
 ike 0: found VPN_1_0 200.200.200.200 5 -> 172.16.55.125:4500
 ike 0:VPN_1_0:199: notify msg received: R-U-THERE-ACK
 ike 0:VPN_1_0: link is idle 5 200.200.200.200->172.16.55.125:4500 dpd=1 seqno=3
 ike 0:VPN_1_0:199: send IKEv1 DPD probe, seqno 3
 ike 0:VPN_1_0:199: confirmed nat-t RFC 3947
 

[FTGmaster]

did you create the static route for both the fgt? (IP-Mask) Dest_add (device) YourVPN and i' m not sure of what you put as source_add and dest_addr of phase2. try: source_add: your local lan .0/24 (if you have all the subnet) dest_addr: remote lan .0/24 (if you have all the subnet)

[Leandro]

Hello FTGmaster, I didn' t create a route because I' m trying to connect a client to the fortigate, not a VPN between 2 fortigates, is that what you meant? For destination I put the LAN behind the internal fortigate unit and for source I leaved " 0.0.0.0/0" for all address. That' s how it is my Phase 2:

[Leandro]

I' ve also tried to change de destination address to another subnet that I created but the tunnel doesn' t complete the negotiation. Any clues?

[guygox]

I have the same problem. Cannot get an IP through IPSEC DHCP.... Phase 2 does not complete. If " acquire virtual IP" is not checked on the forticlient it works... Please help.. If I use Tunnel Mode instead of Interface mode, it works. My virtual interface get an IP address... I' ve found on forums similar problems but no answer...Except this article : http://www.netexpertise.eu/en/fortinet/fortigate-dialup-vpn-client-gets-no-dhcp-lease.html but it applies to tunnel mode so I don' t know if I have to had a policy

[Leandro]

I' ve tried that too, but it didn' t work so far.

[pkley]

Upgrade to 4.3, they made dialup WAY easier and it actually works. I think there' s an issue with 4.2, I just was trying this and gave up (even tech support couldn' t make it work) since we' re rolling out to newer hardware as we speak and I' ll just set it up on 5.0.1.