Hot!First User disconnected once second users successfully connects to Remote Access IPSec VPN

New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/03/09 00:51:41
  • Status: offline
2018/04/20 00:06:02 (permalink)

First User disconnected once second users successfully connects to Remote Access IPSec VPN

Hello Folks,
I have configured Remote Access IPsec VPN on 50E model in SOHO environment. Whenever,first user (i.e. User1) connects through VPN then it works very fine but as soon as new user (i.e. User2) tries same time (ifcourse on Same LAN) then first user gets disconnected automatically. I have very simple setup but unable to track this issue. Any guess in order to check specific setup related issue? Both users have different password and different usernames.
Any guess what could be the issue? Appriciate your support  on this.
Mayur Rajyaguru

1 Reply Related Threads

    New Member
    • Total Posts : 1
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/09 21:12:29
    • Location: Bangalore, India
    • Status: offline
    Re: First User disconnected once second users successfully connects to Remote Access IPSec 2018/08/09 22:27:11 (permalink)
    Hello Mayur,
    * When two PCs are connected to a Dial UP IPSec from a same site. If you are observing the second PC connects, it brings down the VPN of the first PC which is already connected. 
    * Then for FGT, the connection appears to be coming from the same public IP and the same port. 

    * But there are two different users, still FGT can't maintain the two tunnels since traffic is coming from the same public IP. 
    If you would collect the debug logs using the below commands, when trying to connect the second device while first device is already connected to the VPN you would observe the output as mentioned below,
    Debug commands:
    diagnose debug reset 
    diagnose vpn ike log-filter clear 
    diagnose vpn ike log-filter dst-addr4 x.x.x.x ------------where x.x.x.x is the remote gatewayIP 
    diagnose debug app ike -1 
    diagnose debug enable 
    Debug Output:
    ike 0:VPN_SIFY: adding new dynamic tunnel for 175.x.x.x:4500 
    ike 0:VPN_SIFY_162: added new dynamic tunnel for 175.x.x.x:4500 
    ike 0:VPN_SIFY_162: add connected route 169.y.y.y -> 169.y.y.y
    ike 0:VPN_SIFY_162:261344: established IKE SA b75a14f7afd50868/48330d8e31f77a28 
    ike 0:VPN_SIFY_162: twin connections detected  ------------------------------->> twin connections
    ike 0:VPN_SIFY_175: deleting 
    ike 0:VPN_SIFY_175: flushing 
    ike 0:VPN_SIFY_175: deleting IPsec SA with SPI 2e428f01 
    ike 0:VPN_SIFY_175:VPN_SIFY: deleted IPsec SA with SPI 2e428f01, SA count: 0 
    ike 0:VPN_SIFY_175: sending SNMP tunnel DOWN trap for VPN_SIFY 
    ike 0:VPN_SIFY_175:251215381: del route 10.x.x.x/ oif VPN_SIFY_175(244517) metric 15 priority 0 
    ike 0:VPN_SIFY_175:VPN_SIFY: delete 

    So I would advise you to check with the below options: 

    1) If the remote end router or the L3 device is capable of doing PAT, then you can turn on the PAT. 

    2) Another option would be to create different vpn dial-up tunnels for each client differentiating the Client's connection based on peer ID, so that each connection can be identified separately. 
    This means creating separate dial-up connections on the fortigate for the clients connecting from the same ISP location which cannot do PAT. 

    3) Alternatively, you can make a site to site IPSec VPN with the remote. 
    This will bypass all the overheads of creating separate tunnels and simplify the configuration. The other advantage would be that many clients would be able to securely access the internal resources without the need of Client specific tunnels.
    Akilesh C
    Jump to:
    © 2019 APG vNext Commercial Version 5.5