fortigate-ipsec-40-mr3

Monitoring and troubleshooting VPN troubleshooting tips
VPN troubleshooting tips
More in-depth VPN troubleshooting can be found in the Troubleshooting guide.
The VPN proposal is not connecting
One side may attempt to initiate the VPN tunnel unsuccessful. There are a number of
potential reasons for this problem.
Attempting hardware offloading beyond SHA1
If you are trying to off-load VPN processing to a network processing unit (NPU),
remember that only SHA1 authentication is supported. For high levels of authentication
such as SHA256, SHA384, and SHA512 hardware offloading is not an option — all VPN
processing must be done in software.
Check Phase 1 proposal settings
Ensure that both sides have at least one Phase 1 proposal in common. Otherwise they
will not connect. If there are many proposals in the list, this will slow down the negotiating
of Phase 1. If its too slow, the connection may timeout before completing. If this happens,
try removing some of the unused proposals.
Ensure you are not using a loopback for the local VPN interface
The Local Interface field in Phase 1 VPN configuration cannot not be configured to point
to a loopback interface, or the IPSec tunnel will not be established.
Check your routing
If routing is not properly configured with an entry for the remote end of the VPN tunnel,
traffic will not flow properly. You may need static routes on both ends of the tunnel. If
routing is the problem, the proposal will likely setup properly but no traffic will flow.
Try enabling XAuth
If one end of an attempted VPN tunnel is using XAuth and the other end is not, the
connection attempt will fail. The log messages for the attempted connection will not
mention XAuth is the reason, but when connections are failing it is a good idea to ensure
both ends have the same XAuth settings. If you do not know the other end’s settings
enable or disable XAuth on your end to see if that is the problem.
General troubleshooting tips
Most connection failures are due to a configuration mismatch between the FortiGate unit
and the remote peer. In general, begin troubleshooting an IPsec VPN connection failure
as follows:
1 Ping the remote network or client to verify whether the connection is up. See “Testing
VPN connections” on page 236.
2 Traceroute the remote network or client. If DNS is working, you can use domain
names. Otherwise use IP addresses.
3 Check the routing behind the dialup client. Routing problems may be affecting DHCP.
If this appears to be the case, configure a DHCP relay service to enable DHCP
requests to be relayed to a DHCP server on or behind the FortiGate server.
4 Verify the configuration of the FortiGate unit and the remote peer. Check the following
IPsec parameters:
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 241
http://docs.fortinet.com/