IPsec dialup VPN with certificate authentication

[KOMPAKT]

Hi All,

we are trying to establish an IPsec dialup connection between a router and a FGT 100EF with certificate authentication.  Only for your information: The VPN configuration we already have is functional with PSK authentication, so the VPN IPsec config on both sides is OK. When we change the authentication from PSK to certificate, we get an issue.  We generated a ca certificate and signed with it a server and a client certificate with openssl.  We installed the ca and server certificate on the FGT 100EF, and on the other router we installed the ca and client certificate. When the router tries to establish a connection to the FGT 100EF we get an authentication error:

[style="background-color: #ffff99;"]ike 6:S2S_MSB099:95562: received peer identifier DER_ASN1_DN 'C = DE, ST = NRW, O = KomMITT, CN = 10.226.15.66'[/style] [style="background-color: #ffff99;"]ike 6:S2S_MSB099:95562: re-validate gw ID[/style] [style="background-color: #ffff99;"]ike 6:S2S_MSB099:95562: gw validate okay[/style] [style="background-color: #ffff99;"]ike 6:S2S_MSB099:95562: Validating X.509 certificate[/style] [style="background-color: #ffff99;"]ike 6:S2S_MSB099:95562: peer cert, subject='10.226.15.66', issuer='10.226.15.66'[/style] [style="background-color: #ffff99;"]ike 6:S2S_MSB099:95562: peer ID verified[/style] [style="background-color: #ffff99;"]ike 6:S2S_MSB099:95562: building fnbam peer candidate list[/style] [style="background-color: #ffff99;"]ike 6:S2S_MSB099:95562: FNBAM_GROUP_NAME candidate '10.226.15.66'[/style] [style="background-color: #ffff99;"]ike 6:S2S_MSB099:95562: certificate validation pending[/style] [style="background-color: #ffff99;"]ike 6:S2S_MSB099:95562: certificate validation failed[/style]

[style="background-color: #ff9900;"]config vpn ipsec phase1-interface[/style]

[style="background-color: #ff9900;"] edit "S2S_MSB099"[/style] [style="background-color: #ff9900;"] set type dynamic[/style] [style="background-color: #ff9900;"] set interface "vlink_MSB1"[/style] [style="background-color: #ff9900;"] set ip-version 4[/style] [style="background-color: #ff9900;"] set ike-version 1[/style] [style="background-color: #ff9900;"] set local-gw 0.0.0.0[/style] [style="background-color: #ff9900;"] set keylife 86400[/style] [style="background-color: #ff9900;"] set authmethod signature[/style] [style="background-color: #ff9900;"] set mode main[/style] [style="background-color: #ff9900;"] set peertype peer[/style] [style="background-color: #ff9900;"] set exchange-interface-ip disable[/style] [style="background-color: #ff9900;"] set mode-cfg disable[/style] [style="background-color: #ff9900;"] set proposal aes256-sha1[/style] [style="background-color: #ff9900;"] set add-route enable[/style] [style="background-color: #ff9900;"] set localid "CN=10.226.15.66"[/style] [style="background-color: #ff9900;"] set localid-type auto[/style] [style="background-color: #ff9900;"] set negotiate-timeout 30[/style] [style="background-color: #ff9900;"] set fragmentation enable[/style] [style="background-color: #ff9900;"] set dpd on-demand[/style] [style="background-color: #ff9900;"] set forticlient-enforcement disable[/style] [style="background-color: #ff9900;"] set comments ''[/style] [style="background-color: #ff9900;"] set npu-offload enable[/style] [style="background-color: #ff9900;"] set send-cert-chain enable[/style] [style="background-color: #ff9900;"] set dhgrp 5[/style] [style="background-color: #ff9900;"] set suite-b disable[/style] [style="background-color: #ff9900;"] set wizard-type custom[/style] [style="background-color: #ff9900;"] set xauthtype disable[/style] [style="background-color: #ff9900;"] set idle-timeout disable[/style] [style="background-color: #ff9900;"] set ha-sync-esp-seqno enable[/style] [style="background-color: #ff9900;"] set auto-discovery-sender disable[/style] [style="background-color: #ff9900;"] set auto-discovery-receiver disable[/style] [style="background-color: #ff9900;"] set auto-discovery-forwarder disable[/style] [style="background-color: #ff9900;"] set nattraversal enable[/style] [style="background-color: #ff9900;"] set rekey enable[/style] [style="background-color: #ff9900;"] set enforce-unique-id disable[/style] [style="background-color: #ff9900;"] set certificate "server"[/style] [style="background-color: #ff9900;"] set default-gw 0.0.0.0[/style] [style="background-color: #ff9900;"] set default-gw-priority 0[/style] [style="background-color: #ff9900;"] set peer "10.226.15.66"[/style] [style="background-color: #ff9900;"] set net-device disable[/style] [style="background-color: #ff9900;"] set tunnel-search selectors[/style] [style="background-color: #ff9900;"] set keepalive 10[/style] [style="background-color: #ff9900;"] set distance 15[/style] [style="background-color: #ff9900;"] set priority 0[/style] [style="background-color: #ff9900;"] set dpd-retrycount 3[/style] [style="background-color: #ff9900;"] set dpd-retryinterval 20[/style] [style="background-color: #ff9900;"] next[/style]

[style="background-color: #ff9900;"]config vpn ipsec phase2-interface[/style]

[style="background-color: #ff9900;"]edit "S2S_MSB099"[/style] [style="background-color: #ff9900;"] set phase1name "S2S_MSB099"[/style] [style="background-color: #ff9900;"] set proposal aes256-sha1[/style] [style="background-color: #ff9900;"] set pfs enable[/style] [style="background-color: #ff9900;"] set dhgrp 5[/style] [style="background-color: #ff9900;"] set replay enable[/style] [style="background-color: #ff9900;"] set add-route phase1[/style] [style="background-color: #ff9900;"] set auto-discovery-sender phase1[/style] [style="background-color: #ff9900;"] set auto-discovery-forwarder phase1[/style] [style="background-color: #ff9900;"] set keylife-type seconds[/style] [style="background-color: #ff9900;"] set single-source disable[/style] [style="background-color: #ff9900;"] set route-overlap use-new[/style] [style="background-color: #ff9900;"] set encapsulation tunnel-mode[/style] [style="background-color: #ff9900;"] set comments ''[/style] [style="background-color: #ff9900;"] set protocol 0[/style] [style="background-color: #ff9900;"] set src-addr-type subnet[/style] [style="background-color: #ff9900;"] set src-port 0[/style] [style="background-color: #ff9900;"] set dst-addr-type subnet[/style] [style="background-color: #ff9900;"] set dst-port 0[/style] [style="background-color: #ff9900;"] set dhcp-ipsec disable[/style] [style="background-color: #ff9900;"] set keylifeseconds 3600[/style] [style="background-color: #ff9900;"] set src-subnet 192.168.100.0 255.255.255.0[/style] [style="background-color: #ff9900;"] set dst-subnet 10.26.245.0 255.255.255.0[/style] [style="background-color: #ff9900;"] next[/style]

[style="background-color: #ff9900;"]end[/style]

Does somebody has an idea what's the issue? Many Thanks in Advance.

[btp]

I had the exact same issue. The solution for me was to add the CA certificate on the spoke side. It wasn't added when generating the cert from the FortiManager. 

(Please mark the post as Answered if you feel it does so..)