IPSEC is a complicated protocoll, so debugging is often needed.
To enable debugging on FortiGate firewalls you can use these commands:
# reset any filter
diagnose vpn ike log-filter clear
# filter for a specific client on ip x.x.x.x
diagnose vpn ike log-filter dst-addr4 x.x.x.x
diagnose debug application ike -1
diagnose debug enable
If this ipsec configuration uses SAML (sso, entra ID) it's often a SAML problem
and not related to ipsec. Add saml debugging with:
diagnose debug application samld -1
diagnose debug application fnbamd -1
Deaktivate debugging with:
diagnose debug disable
diagnose debug reset
More commands to control ipsec:
# check if actuall ipsec packets are reaching the firewall
diagnose sniffer packet any 'host x.x.x.x and udp port 500' 4 0 l
# show status of ipsec tunnels
diagnose vpn tunnel list
# clear a ipsec tunnel
diagnose vpn ike gateway clear name <VPN-Phasen-Name>
Version: tested with FortiOS 7.2