First User disconnected once second users successfully connects to Remote Access IPSec VPN

[Mayurjrajyaguru]

Hello Folks,

I have configured Remote Access IPsec VPN on 50E model in SOHO environment. Whenever,first user (i.e. User1) connects through VPN then it works very fine but as soon as new user (i.e. User2) tries same time (ifcourse on Same LAN) then first user gets disconnected automatically. I have very simple setup but unable to track this issue. Any guess in order to check specific setup related issue? Both users have different password and different usernames.

Any guess what could be the issue? Appriciate your support  on this.

Regards,

Mayur Rajyaguru

[Akilesh]

Hello Mayur,

* When two PCs are connected to a Dial UP IPSec from a same site. If you are observing the second PC connects, it brings down the VPN of the first PC which is already connected. 

* Then for FGT, the connection appears to be coming from the same public IP and the same port. 

* But there are two different users, still FGT can't maintain the two tunnels since traffic is coming from the same public IP. 

If you would collect the debug logs using the below commands, when trying to connect the second device while first device is already connected to the VPN you would observe the output as mentioned below,

Debug commands:

diagnose debug reset  diagnose vpn ike log-filter clear  diagnose vpn ike log-filter dst-addr4 x.x.x.x ------------where x.x.x.x is the remote gatewayIP  diagnose debug app ike -1  diagnose debug enable 

Debug Output:

--------------------------------------------------------------------------------- 

ike 0:VPN_SIFY: adding new dynamic tunnel for 175.x.x.x:4500  ike 0:VPN_SIFY_162: added new dynamic tunnel for 175.x.x.x:4500  ike 0:VPN_SIFY_162: add connected route 169.y.y.y -> 169.y.y.y ike 0:VPN_SIFY_162:261344: established IKE SA b75a14f7afd50868/48330d8e31f77a28  ike 0:VPN_SIFY_162: twin connections detected  ------------------------------->> twin connections ike 0:VPN_SIFY_175: deleting  ike 0:VPN_SIFY_175: flushing  ike 0:VPN_SIFY_175: deleting IPsec SA with SPI 2e428f01  ike 0:VPN_SIFY_175:VPN_SIFY: deleted IPsec SA with SPI 2e428f01, SA count: 0  ike 0:VPN_SIFY_175: sending SNMP tunnel DOWN trap for VPN_SIFY  ike 0:VPN_SIFY_175:251215381: del route 10.x.x.x/255.255.255.255 oif VPN_SIFY_175(244517) metric 15 priority 0  ike 0:VPN_SIFY_175:VPN_SIFY: delete  ---------------------------------------------------------------------------------  So I would advise you to check with the below options:  1) If the remote end router or the L3 device is capable of doing PAT, then you can turn on the PAT.  2) Another option would be to create different vpn dial-up tunnels for each client differentiating the Client's connection based on peer ID, so that each connection can be identified separately.  This means creating separate dial-up connections on the fortigate for the clients connecting from the same ISP location which cannot do PAT.  3) Alternatively, you can make a site to site IPSec VPN with the remote.  This will bypass all the overheads of creating separate tunnels and simplify the configuration. The other advantage would be that many clients would be able to securely access the internal resources without the need of Client specific tunnels.

Regards,

Akilesh C

[Umesh]

Hello all,

I have some query about fortinet L2TP vpn, I have two PC which is connected to my wifi network and I'm using for this wifi Tenda wireless router.

When I connect one PC to the Fortinet L2tp vpn through wifi router, then connectivity is fine. but I get disconnected while connecting L2tp vpn which is deployed in our organization. I would like to tell you I have done everting from our side also I went through Google but did'nt find any better solution. Request you to all please share any solution for it. your reply will be valuable for me .

I'm are getting error from  Error 809. I have checked with my windows firewall and registry value but couldn't resolved it. 

Warm Regards,

Umesh Prajapati