u/Even-Camel7593

Hello everyone! I'm trying to configure RA IPSec VPN with IKEv2. My issue is, the gateway looks like thiks:

edit "Dialup_cert_2"

set type dynamic

set interface "VL1461"

set ike-version 2

set authmethod signature

set net-device disable

set mode-cfg enable

set ipv4-dns-server1 192.168.104.252

set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256

set dpd on-idle

set dhgrp 5 14 20

set eap enable

set eap-identity send-request

set eap-cert-auth enable

set cert-peer-username-validation cn

set certificate "wildcard"

set peer "IKE2_TEST"

set ipv4-start-ip 10.0.1.1

set ipv4-end-ip 10.0.1.254

set ipv4-netmask 255.255.255.0

set dpd-retryinterval 60

next

end

My peer looks like this:

sh user peer IKE2_TEST

config user peer

edit "IKE2_TEST"

set ca "CA_Cert_4"

set cn "O=A, C=B, OU=C"

next

end

And everytime I try to connect to the gateway on my iPhone, I get the following debug:

ike V=root:0:Dialup_cert_2:26319: peer identifier IPV4_ADDR 192.168.0.72
ike V=root:0:Dialup_cert_2:26319: re-validate gw ID
ike V=root:0:Dialup_cert_2:26319: gw validation failed

When I try to actually input certificate fields in the localid, I get the following:

ike V=root:0:Dialup_cert_2:26341: received peer identifier FQDN 'O=A,C=B,OU=C '
ike V=root:0:Dialup_cert_2:26341: re-validate gw ID
ike V=root:0:Dialup_cert_2:26341: gw validation failed

I do understand that the firewall reads it like a string, not like actual certificate fields. My question is: is there a way make FortiClient send it correctly? Perhaps some service characters or something like that. Otherwise I'll be rolling back to IKEv1.

Any help is appreciated! Thanks in advance!

Hello everyone! I'm looking for a way to make FortiClient (the free one, VPN only) save user password. When I fresh install FortiClient VPN (7.4.3 hotfix 1.8758), this checkbox is not present at all. I've read some manuals on XML configs and found configuration parameters that make this checkbox visible. I craft a .conf file with the parameters, import it, the checkbox I wanted is present, but once my connection is establishsed, the utility goes to tray, and then I untray it back (a lock sign in the top right corner is present even if I turned it off before), I break the connection I've just established, and all the checkboxes are gone from GUI.

What am I doing wrong and how to fix it? It's just really frustrating to re-enter my password everytime. Any help is appreciated. Thanks in advance!

Hello everybody! I have a Fortigate and an Ubuntu server. There's an IPSec tunnel between the devices, and there's an SDWAN rule on the Fortigate that sends traffic to Telegram to that tunnel interface. When explicit proxy is turned off, everything works, Telegram opens, traffic traverses just fine. But when I turn on explicit proxy, I get timeouts, and TCPDUMP on Ubuntu host shows to packets to that destination whatsoever. No idea where to even begin. Would appreciate any help. Thanks in advance!

Hello everone! I am new to Fortigates and looking to know the best practices to establish reliable route exchange between old Cisco router (800 model, ultra legacy) and a Fortigate 120G (our new hub device). I've already established two GRE over IPSec tunnels (Cisco has a public address and a Fortigate has two public addresses). There is a simple way to consider one tunnel main channel and the other tunnel the reserve, but I wonder if there's a way to make use of SDWAN on the Hub side. For example announce BGP routes with preferable metrics via a tunnel that is in SLA and at the same time route traffic to Cisco side via a tunnel that is in SLA (well, the second part is not really a problem, just health-checks and SDWAN rules, if first rule is out of SLA, then we go second rule). But what are the best practices to deliver "healthy" routes to Cisco?

Any advise is appreciated! Thanks in advance.