The CLI must be used to set up this configuration because it is not possible to edit multiple pools on the same interface using the GUI.

Last Modified Date: 06-30-2016 Document ID: FD33842.

To confirm that a VPN between a local network and a dialup client has been configured correctly, at the dialup client, issue a ping command to test the connection to the local network.

It is easiest to see if the final stage is successful first since if it is successful the other stages will be working properly.

Otherwise, you will need to work back through the stages to see where the problem is located.

If you can determine the connection is working properly then any problems are likely problems with your applications.

Otherwise, use the IP address of the first interface from the interface list (that has an IP address).

This kind of information in the resulting output can make all the difference in determining the issue with the VPN.

Bear in mind that the troubleshooting suggestions below are not exhaustive, and may not reflect your network topology.

You might need to pin the PATNAT session table, or use some of kind of NAT-T keepalive to avoid the expiration of your PATNAT translation.

Furthermore, in circumstances where multiple remote dialup VPN tunnels exist, each tunnel must have a peer ID set.

You can use the diagnose vpn tunnel list command to troubleshoot this.

If part of the setup currently uses firewall addresses or address groups, try changing it to either specify the IP addresses or use an expanded address range.

This is especially useful if the remote endpoint is not a FortiGate device.

A 1500 byte MTU is going to exceed the overhead of the ESP-header, including the additional ipheader,etc.

If a duplicate instance of the VPN tunnel appears on the IPsec Monitor, reboot your FortiGate unit to try and clear the entry.

When you are finished, disable the diagnostics by using the following command.

If it is a PSK mismatch, you should see something similar to the following output.

Without a match and proposal agreement, Phase 1 can never establish.

Use the following command to show the proposals presented by both parties.

If the connection is properly configured, a VPN tunnel will be established automatically when the first data packet destined for the remote network is intercepted by the FortiGate unit.

You can confirm this by going to Monitor IPsec Monitor where you will be able to see your connection.

A green arrow means the tunnel is up and currently processing traffic.

A red arrow means the tunnel is not processing traffic, and this VPN connection has a problem.

Fortigate Dhcp Relay Debug