This section provides an example of a non-default IPsec VPN configuration. You can use this configuration if FortiClient fails to connect to IPSec VPN, and you see the following symptom:
- When you view the FortiGate IKE debug log, you see that FortiOS sends
R_U_THEREto FortiClient, but there is no reply, and it times out.
In this case, you can increase the FortiGate DPD wait time and/or enable FortiClient IPSec multi-thread mode. However, it is recommended not to enable FortiClient IPSec multi-thread mode if it is not necessary. You must make changes to the FortiGate configuration and the FortiClient configuration.
Increase the FortiGate DPD wait time by using the following FortiOS CLI:
config vpn ipsec phase1-interface
edit <your IPSec VPN>
set dpd-retrycount <give it a bigger number>
set dpd-retryinterval <give it a bigger number>
- Enable multi-thread mode on FortiClient by using XML:
<name>your IPSec VPN</name>