Reference

https://community.fortinet.com/fortigate-3/technical-tip-how-to-use-tcp-as-the-failback-transport-for-ike-163409

https://docs.fortinet.com/document/fortigate/7.6.5/fortios-release-notes/584870/gui-access-conflict-with-ipsec-tcp-tunnel-on-the-same-interface

Situation

# IPsec建立後該介面無法用HTTPS存取GUI介面
Unable to access the Web GUI via HTTPS on this interface after the IPsec tunnel is established.

Introduction

# IPsec IKEv1 只有UDP版本
IPsec IKEv1 only supports UDP.

# IPsec IKEv2 在7.4.2之後加入IKEv2 over TCP 4500, 7.6.1改成TCP 443
IPsec IKEv2 added support for IKEv2 over TCP port 4500 starting in version 7.4.2, which was later changed to TCP port 443 in version 7.6.1.

Solution

[1]
Log in Fortigate WebUI > CLI

[2]
# 方法1 : 改admin port
config system global
    set admin-sport <port>
end

# 方法2 : 改IKE-TCP-Port
config system settings
    set ike-tcp-port <port>
end

# 方法3 : 指定UDP, 不用Auto(先UDP再TCP)
WebUI > VPN > IPsec > Tunnels > Network > Transport > UDP

[3]
# 確認IKE-TCP-Port
show system settings | grep ike-tcp-port

# 確認Web HTTPS的Port
show system global | grep -E "(http-port|https-port)"