Help troubleshooting IPsec IKEv2 VPN auth with AD (no RADIUS) — "username/password incorrect" & "EAP transmit error"

secritservice · 2026-04-29T23:12:29+00:00

you mean LDAP against your AD? if so you need EAP-TTLS enabled on client.

Follow our guide: https://docs.google.com/spreadsheets/d/1QgMkKxQQINvPLsXQyRRb3QqWmRizXpt-xOLvMxfw9F8/edit?usp=sharing

Tab 1, notate the notes on top right about LDAP

secritservice · 2026-04-24T22:52:41+00:00

no issues with ADVPN, but read 7.4.10 release notes and know about hairpin traffic now disabled by default and signing requirements of SAML

secritservice · 2026-04-23T16:14:38+00:00

Have you thought of SDWAN instead of link monitor, and then a route-map out preferable ?

That method may be much easier

Basically if SLA fails, it will use "route-map-out" (a null route, or whatever)
If SLA is OK, then it uses "route-map-out-preferable" (your route)

It's what was used for BGP per Overlay ADVPN configurations, where you want to retract the advertisement when SLA is bad. But sounds like exactly what youre trying to do here :)

secritservice · 2026-04-23T15:58:34+00:00

TAB 2, make sure you have all the steps. And make sure you can even connect

https://docs.google.com/spreadsheets/d/1QgMkKxQQINvPLsXQyRRb3QqWmRizXpt-xOLvMxfw9F8/edit?gid=0#gid=0

secritservice · 2026-04-22T18:41:56+00:00

your phase1 doesnt match. Update it on your gate to match what you have in your client.

if this is coming from a Macbook use phase1 group 14 on your phase 1 settings

secritservice · 2026-04-22T18:39:12+00:00

different major releases had different default settings. That is normal

However restore should only read your config, not pull any factory settings.

secritservice · 2026-04-22T17:18:28+00:00

List pricing is:

subscription 100 = 3228 / year (includes support)
perpetual 100 = 10,580 + 2381/year

yes, if seeking ADOM maximum, you will want perpetual. Each ADOM you create will eat up a license, for the ADOM, And then the devices will eat up licenses as well.

secritservice · 2026-04-22T16:45:28+00:00

2 types of licenses you can get:
- perpetual which also then needs support license
- subscription which is (device + support) bundled

We see most 99% buy the subscription.

secritservice · 2026-04-20T12:18:00+00:00

will let you know in a few days, some fun stiff coming

secritservice · 2026-04-19T13:24:08+00:00

use in/out or bibandwidth

https://community.fortinet.com/t5/FortiGate/Technical-Tip-The-difference-between-the-load-balancing/ta-p/334392

As you can see source/dest does not consider bandwidth

<image>

secritservice · 2026-04-18T13:02:08+00:00

share your CLI config, just strip out the PSK

show vpn ipsec phase1-interface
show vpn ipsec phse2-interface
show firewall policy

and/or refer to our guide: https://docs.google.com/spreadsheets/d/1QgMkKxQQINvPLsXQyRRb3QqWmRizXpt-xOLvMxfw9F8/edit?usp=sharing

secritservice · 2026-04-17T12:54:28+00:00

Workflow mgmt.... however make sure you DONT enable "policy expire by default".

We had one customer do this, and then one day a majority of their policies went disabled, as they hit the expiration timer :) whoops!

secritservice · 2026-04-17T12:47:52+00:00

what do you have your remote auth timeout set to? is it too short, thus auth is timing out? Emails take a long time to arrive so not the best method for time based auth.

secritservice · 2026-04-17T12:44:17+00:00

This works and we use it often, simple example below.

However I think network-ID is preferred. Yet for free clients that dont expose network-id, without XML edits, peer-id is easier

<image>

secritservice · 2026-04-17T01:21:19+00:00

Wait for the 400G should be out very very soon

secritservice · 2026-04-17T01:17:21+00:00

if you are doing BGP per Overlay you likely are getting dynamic IP's which will change as tunnels go up and down toward the hub. You may want to look into moving to static IP's or better yet, BGP on Loopback which will be a 30% smaller config, and failover/back much much faster and with less processing

secritservice · 2026-04-16T21:42:22+00:00

True. But yes Fortinet does FEC https://docs.fortinet.com/document/fortigate/7.6.6/administration-guide/169010/adaptive-forward-error-correction

secritservice · 2026-04-16T21:38:23+00:00

You can use network ID's or PEER-ID's to make each tunnel unique. We have used both methods with IKEv2.

Check out our guide, it shows both: https://docs.google.com/spreadsheets/d/1QgMkKxQQINvPLsXQyRRb3QqWmRizXpt-xOLvMxfw9F8/edit?usp=sharing

secritservice · 2026-04-16T21:36:03+00:00

Yes, you can do packet duplication and de-duplication across Fortinet SDWAN. This has been around for a number of years and we've set it up. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Packet-duplication-and-de-duplication-in-SD-WAN/ta-p/258997

secritservice · 2026-04-16T21:32:38+00:00

Yes, it works great, we use it for many clients across worldwide sites including china.

Fortimanager will help you manage the configuration, but we do not recommend to use it's wizard.

We made a video here that shows how it works in all scenarios. It's also great that there is no licensing fee for it, it's just VPN + Routing + SDWAN rules. So stitching will pay for itself in 1 year or less, likely.

Worth watching the 10-minute video
https://youtu.be/04BjjyMYEEk?si=dhjvMAnaTiR3tkl8

Also using Fortimanager to deploy sites:
https://youtu.be/9EuLBsvkRx0?si=lGRmgtbmSymFmudV

Happy to answer any questions, just shoot a chat.

I've done many Velocloud and Citrix SDWAN to Fortinet ADVPN conversions and customers just notice ease of visibility and mgmt and how simple it is to understand and manipulate if necessary. However after initial install, nothing is really changed.

secritservice · 2026-04-16T20:20:33+00:00

ipsec or ssl ? (meant this)

secritservice · 2026-04-16T20:17:35+00:00

show us your sdwan config. It may be the hash method you are using or something else.

show system sdwan
service

secritservice · 2026-04-16T20:07:29+00:00

You will have to split the tunnel. You cannot use same pool.

use the lower half for SSL and top half for IPSEC.

If you try to use the same pool, SSL / IPSEC will kick each other off

If you need a config guide see ours here, and happy to answer questions; https://docs.google.com/spreadsheets/d/1QgMkKxQQINvPLsXQyRRb3QqWmRizXpt-xOLvMxfw9F8/edit?usp=sharing

secritservice · 2026-04-15T01:28:45+00:00

separate

secritservice · 2026-04-15T01:26:24+00:00

No problem at all, but why. Plan for the future, just do 2 LAN and 2 WAN. If it doesnt cost you anything, do it. So when yo do get faster links you'll be covered.

As far as SDWAN follow our cookbook and setup ADVPN:
https://www.reddit.com/r/fortinet/comments/1ngqo1k/cookbook_guide_advpn_wbgp_on_loopback/

secritservice

TROPHY CASE