The FortiClient and cisco VPN ( ipsec )

Forticlient is a client  software that supports a host of function 2 of which are  vpn access ( ipsec &  ssl ) .

It's developed by Fortinet,  but you can use it with a cisco ASA or Router as a dialup vpn client.

You can even use it with pfSense for example, or just about a few other dialup ipsec-vpn-devices if you care to edit the xml section under your ipsec connection details and tweak the configurations.

The key for using the client is to modify the xml as required to fit your vpn dialup concentrator. For  access these XML tags should be scrutinize and double check. You might need to ask your firewall/vpn administrator for guidance )

• <dhgroup>
• <localid> ( if your using groups )
• <proposals> ( crypto ciphers are crucial and need to match )

here's snippet of a vpn ipsec connection profile for a cisco device

And here's our  client accessed to our vpn;

Some key-points;

• the forticlient is very versatile as a ipsec client
• it can be used with fortigate and non-Fortigates but requires some tweaking
• XML editing is a must ( make backup before imposing changes )
• validate all profile settings ( Diffie-Hellman, proposals, etc....)
• populate the <localid> if your using vpn groups in your dialup

Error diagnostics from the client are cryptic in nature , but you can get good feedback from the diagnostics and via downloading any logs for ipsec.

Here's a few warnings based on my experience

( mis-match pre-share key)

( mis-match in either ike or ipsec dhgrp  or ciphers proposal )

The FortiClient does not support ikev2

If the PSK does not match, you  will never make it to user authentication ( eXended Authentication     aka xauth )

I've never had any luck with defining < FQDN mypeerid> on pfsense and using  the name@domain format use the keytagID





Ken Felix
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \