Strong swan configuration to match the forticlient configuration

[gscorrea]

I am using forticlient with the following configuration to vpn to a fortigate VPN server. 

Now I need to do the same on my linux VM and I am having trouble configuring my striongswan to match the forticlient configuration.

Would somebody be able to help me with the configuration on strongswan?

<connections>
                <connection>
                    <name>LAB</name>
                    <single_user_mode>0</single_user_mode>
                    <type>manual</type>
                    <ui>
                        <show_passcode>0</show_passcode>
                        <show_remember_password>1</show_remember_password>
                        <show_alwaysup>0</show_alwaysup>
                        <show_autoconnect>0</show_autoconnect>
                        <save_username>0</save_username>
                    </ui>
                    <ike_settings>
                        <implied_SPDO>0</implied_SPDO>
                        <implied_SPDO_timeout>0</implied_SPDO_timeout>
                        <prompt_certificate>0</prompt_certificate>
                        <description>LAB</description>
                        <server><IP address></server>
                        <authentication_method>Preshared Key</authentication_method>
                        <auth_data>
                            <preshared_key>Enc <psk></preshared_key>
                        </auth_data>
                        <mode>aggressive</mode>
                        <dhgroup>5;</dhgroup>
                        <key_life>86400</key_life>
                        <localid />
                        <peerid />
                        <nat_traversal>1</nat_traversal>
                        <mode_config>1</mode_config>
                        <enable_local_lan>0</enable_local_lan>
                        <nat_alive_freq>5</nat_alive_freq>
                        <dpd>1</dpd>
                        <dpd_retry_count>3</dpd_retry_count>
                        <dpd_retry_interval>5</dpd_retry_interval>
                        <enable_ike_fragmentation>0</enable_ike_fragmentation>
                        <xauth>
                            <enabled>1</enabled>
                            <prompt_username>0</prompt_username>
                            <username>Enc <username></username>
                            <password>Enc <password></password>
                        </xauth>
                        <proposals>
                            <proposal>AES128|SHA1</proposal>
                            <proposal>AES256|SHA256</proposal>
                        </proposals>
                    </ike_settings>
                    <ipsec_settings>
                        <remote_networks>
                            <network>
                                <addr>0.0.0.0</addr>
                                <mask>0.0.0.0</mask>
                            </network>
                            <network>
                                <addr>::/0</addr>
                                <mask>::/0</mask>
                            </network>
                        </remote_networks>
                        <dhgroup>5</dhgroup>
                        <key_life_type>seconds</key_life_type>
                        <key_life_seconds>43200</key_life_seconds>
                        <key_life_Kbytes>5120</key_life_Kbytes>
                        <replay_detection>1</replay_detection>
                        <pfs>1</pfs>
                        <use_vip>1</use_vip>
                        <virtualip>
                            <type>modeconfig</type>
                            <ip>0.0.0.0</ip>
                            <mask>0.0.0.0</mask>
                            <dnsserver>0.0.0.0</dnsserver>
                            <winserver>0.0.0.0</winserver>
                        </virtualip>
                        <proposals>
                            <proposal>AES128|SHA1</proposal>
                            <proposal>AES256|SHA1</proposal>
                        </proposals>
                    </ipsec_settings>

[emnoc]

you need to confirm your conn details, Have you done that and follow the thousands of examples on wiki.strongswan?

set the ike/esp algo, rightid , xauth assuming your not doing ikev2 and eap.

e.g 

conn roadwarrierfgt

  # change the alpg to match fortios phase1/phase2 settings

  ike = aes128-sha1-modp2048!  esp = aes128-sha1!  aggressive = yes  ikelifetime = 28800s  rightsubnet=192.168.1.0/24  rightid = %any  rightauth = psk  left = %defaultroute  leftauth = psk  leftauth2 = xauth  # stick your username in  xauth_identity = ken.felix

Ensure ipsec.secret has the proper : psk entry

Run "ipsec restart" ; "ipsec statusall" after making a connection, 

Use "diag debug application ike -1 " of the fortigate to troubleshoot

Ken Felix