FortiGate IPSec VPN User Guide - FirewallShop.com

VPN troubleshooting tips
Monitoring and testing VPNs
3 Refer to Table 2 on page 160 to correct the problem.
Table 2: VPN trouble-shooting tips
Configuration problem
Mode settings do not match.
Peer ID or certificate name of the
remote peer or dialup client is not
recognized by FortiGate VPN
server.
Preshared keys do not match.
Phase 1 or phase 2 key
exchange proposals are
mismatched.
NAT traversal settings are
mismatched.
SPI settings for manual key
tunnels are mismatched.
Correction
Select complementary mode settings. See “Choosing
main mode or aggressive mode” on page 128.
Go to VPN > Phase 1.
Depending on the Remote Gateway and
Authentication Method settings, you have a choice of
options to authenticate FortiGate dialup clients or
VPN peers by ID or certificate name (see
“Authenticating remote peers and clients” on
page 131).
If you are configuring authentication parameters for
FortiClient dialup clients, refer to the Authenticating
FortiClient Dialup Clients Technical Note.
Reenter the preshared key. See “Authenticating
remote peers and clients” on page 131.
Make sure that both VPN peers have at least one set
of proposals in common for each phase. See
“Defining IKE negotiation parameters” on page 137
and “Configure the phase 2 parameters” on page 146.
Select or clear both options as required. See “NAT
traversal” on page 140 and “NAT keepalive frequency”
on page 140.
Enter complementary SPI settings. See “Manual-key
configurations” on page 111.
A word about NAT devices
When a device with NAT capabilities is located between two VPN peers or a VPN
peer and a dialup client, the device must be NAT-T compatible for encrypted traffic
to pass through the NAT device. For more information, see “NAT traversal” on
page 140.
FortiGate IPSec VPN Version 3.0 User Guide
160 01-30005-0065-20070716