SOLUTION: Forticlient VPN

Not really errors, the fortigate tries to send P1 response but fails. Using main or aggressive mode or enabling IKE fragmentation on the client config makes no difference. We are using client certificates with peer groups for authentication reasons

Here the log , the yellow lines is looks look suspicious

ike 0:CP-FC:484: responder:main mode get 2nd message…
ike 0:CP-FC:484: NAT detected: PEER
[ style=”background – color : # ffff00 ; ” ]ike 0 : CP – FC : build certreq for peer client01[ /style ]
[ style=”background – color : # ffff00 ; ” ]ike 0 : CP – FC : unable to build CERTREQ for client01[ /style ]
[ style=”background – color : # ffff00 ; ” ]ike 0 : CP – FC : build certreq for peer client02[ /style ]
[ style=”background – color : # ffff00 ; ” ]ike 0:CP-FC: unable to build CERTREQ for client02[ /style ]
[ style=”background – color : # ffff00 ; ” ]ike 0:CP-FC: building CERTREQ for any[ /style ]
ike 0:CP-FC:483: sent IKE msg (ident_r2send): 95.117.33.150:500->89.204.130.72:16146, len=465, id=7919776837ff80db/afef9b5650fff93e
[style=”background-color: #ff9900;”]ike 0: comes 89.204.130.72:16146->95.117.33.150:500,ifindex=3….[ /style ]
ike 0: IKEv1 exchange=Identity Protection id=7919776837ff80db/afef9b5650fff93e len=356
ike 0:CP-FC:483: retransmission, re-send last message
ike 0:CP-FC:483: sent IKE msg (retransmit): 95.117.33.150:500->89.204.130.72:16146, len=465, id=7919776837ff80db/afef9b5650fff93e
ike 0:CP-FC:483: sent IKE msg (P1_RETRANSMIT): 95.117.33.150:500->89.204.130.72:16146, len=465, id=7919776837ff80db/afef9b5650fff93e
ike 0: comes 89.204.130.72:16146->95.117.33.150:500,ifindex=3….
ike 0: IKEv1 exchange=Identity Protection id=7919776837ff80db/afef9b5650fff93e len=356
ike 0:CP-FC:483: retransmission, re-send last message
ike 0:CP-FC:483: sent IKE msg (retransmit): 95.117.33.150:500->89.204.130.72:16146, len=465, id=7919776837ff80db/afef9b5650fff93e
ike 0 : CP – FC:483 : negotiation timeout , delete
ike 0:CP-FC: connection expiring due to phase1 down
ike 0 : CP – FC : delete
ike 0:CP-FC: flushing
ike 0 : CP – FC : send SNMP tunnel DOWN trap
ike 0:CP-FC: flushed
ike 0:CP-FC: reset NAT-T
ike 0:CP-FC: deleted

The second attempt works and then the logs are different in one point.

ike 0 : CP – FC:485 : responder : main mode get 2nd message …
ike 0:CP-FC:485: NAT detected: PEER
[ style=”background – color : # ffff00 ; ” ]ike 0 : CP – FC : send 1 certreq payload[ /style ]
ike 0:CP-FC:485: sent IKE msg (ident_r2send): 95.117.33.150:500->89.204.130.72:14943, len=361, id=a2611a8be1a0c76f/3855a1dd911dc2e5
[style=”background-color: #ff9900;”]ike 0: comes 89.204.130.72:13539->95.117.33.150:4500,ifindex=3….[ /style ]
ike 0: IKEv1 exchange=Identity Protection id=a2611a8be1a0c76f/3855a1dd911dc2e5 len=1324
ike 0:CP-FC:485: responder: main mode get 3rd message…

I just noticed another difference (marked in orange):

In the first fail connection attempt the forticlient answer to the fortigate on port 500 , on the second on 4500 , which should be the correct port because of the NAT detection …