LibreSwan -> Fortigate (IPsec only, no SSL) gives: 60 second timeout exceeded after 7 retransmits. No response to our first IKEv2 message

Question

I'm attempting to get a Linux (Debian 10.10) client VPN'ing to a Fortigate server.

This is apparently not that well explored.

There's this document: https://kb.fortinet.com/kb/documentLink.do?externalID=11835 ...which I've been basing my work on, but I'm still getting:

STATE_PARENT_I1: 60 second timeout exceeded after 7 retransmits.  No response (or no acceptable response) to our first IKEv2 message

Or more specifically:

002 "officelan": deleting non-instance connection
002 "officelan" #10: deleting state (STATE_PARENT_I1) and NOT sending notification
002 added connection description "officelan"
002 "officelan" #11: initiating v2 parent SA
133 "officelan" #11: initiate
002 "officelan" #11: constructed local IKE proposals for officelan (IKE SA initiator selecting KE): 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_256;INTEG=NONE;DH=MODP2048
133 "officelan" #11: STATE_PARENT_I1: sent v2I1, expected v2R1
010 "officelan" #11: STATE_PARENT_I1: retransmission; will wait 0.5 seconds for response
010 "officelan" #11: STATE_PARENT_I1: retransmission; will wait 1 seconds for response
010 "officelan" #11: STATE_PARENT_I1: retransmission; will wait 2 seconds for response
010 "officelan" #11: STATE_PARENT_I1: retransmission; will wait 4 seconds for response
010 "officelan" #11: STATE_PARENT_I1: retransmission; will wait 8 seconds for response
010 "officelan" #11: STATE_PARENT_I1: retransmission; will wait 16 seconds for response
010 "officelan" #11: STATE_PARENT_I1: retransmission; will wait 32 seconds for response
031 "officelan" #11: STATE_PARENT_I1: 60 second timeout exceeded after 7 retransmits.  No response (or no acceptable response) to our first IKEv2 message
000 "officelan" #11: starting keying attempt 2 of an unlimited number, but releasing whack

I'm using these commands to obtain the above:

systemctl start ipsec.service
/usr/sbin/ipsec auto --add officelan
/usr/sbin/ipsec auto --up officelan

My /etc/ipsec.d/officelan.conf looks like:

conn officelan
    rekey=yes
    rightid=officelan
    left=192.168.1.101
    leftsubnet=192.168.1.0/24
    right=<redacted-ip-address>
    rightsubnet=172.40.0.0/24
    ikelifetime=28800s
    authby=secret
    type=tunnel
    auto=start
    ike=aes_gcm256-sha2
    esp=aes_gcm256-null
    ikev2=insist
    fragmentation=yes
    #perfect forward secrecy (default yes)
    #pfs=no
    #optionally enable compression
    compress=yes

And my /etc/ipsec.d/officelan.secrets looks like:

host.example.com %any : PSK "bigrandomsecret"

I don't really know if this is relevant or not, but ike-scan doesn't like the server:

$ ike-scan ip-of-server.example.com
below cmd output started 2021 Wed Jul 07 03:50:45 PM PDT
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)

Ending ike-scan 1.9.4: 1 hosts scanned in 2.443 seconds (0.41 hosts/sec).  0 returned handshake; 0 returned notify

Here's an nmap of the server (1.1.1.1 is not the real IP address):

$ nmap -P0 -sU -p 500 1.1.1.1
Starting Nmap 7.70 ( https://nmap.org ) at 2021-07-08 07:25 PDT
Nmap scan report for 1.1.1.1
Host is up.

PORT    STATE         SERVICE
500/udp open|filtered isakmp

Nmap done: 1 IP address (1 host up) scanned in 4.16 seconds

Here's ip route show output:

default via 192.168.1.254 dev eno1 proto dhcp metric 100 
169.254.0.0/16 dev eno1 scope link metric 1000 
192.168.1.0/24 dev eno1 proto kernel scope link src 192.168.1.101 metric 100 

I've googled for hours, but I'm still getting timeouts.

I have 3 related questions:

1. How can I establish a working VPN from Debian 10.10 to Fortigate (unknown version, I have no control over the server) using LibreSwan 3.27-6+deb10u1?
2. Why doesn't LibreSwan ask me for my password and 2fa data? When I was trying vpnc, it asked for these every time I tried to initiate a connection.
3. Only if it sounds relevant: Why doesn't ike-scan like the Fortigate server?

Thanks!