Technical Tip: Client network lost connectivity when FortiClient is connecting to IPsec dialup to FortiGate

When FortiClient is connecting to IPsec, the network will be disconnected, and FortiClient only allows traffic for IPsec protocol UDP 500 and 4500, and all other traffic will be blocked. 

If it is not possible to afford, even a short disconnection on the client machine, it will be necessary to change 2 configurations on the FortiClient to allow all traffic to go through during IPsec dial-up. 

This is an expected behavior because the FortiClient only allows traffic from IPsec UDP ports 500 and 4500 as a security feature in the IPsec protocol.

Note: This change has to be done via an XML file or directly in the remote access profile in FortiClient EMS.

1. On the client machine, launch the FortiClient and unlock with administrator rights by selecting the 'Lock' icon and entering the administrator password as required when prompted.
   
   

    

   

    

2. Select the 'settings' icon, and back up the FortiClient configuration, select the destination.
   
   

    

3. Open the saved XML configuration file (.conf) and look for <implied_SPDO> and <implied_SPDO_timeout>. Make sure to edit the desired IPsec connection, as each IPsec connection will have its own <implied_SPDO> and <implied_SPDO_timeout> configuration.

4. Change and save the XML configuration file.

<implied_SPDO> <-- Change to 1. 
<implied_SPDO_timeout> <----- Change to any value greater than 0, basically, how long to have the timeout hold out before the network is disconnected, and this value represents seconds.
 

Example:
Timeout change to 100 seconds: 
 

<ike_settings> 
<version>1</version> 
<implied_SPDO>1</implied_SPDO> 
<implied_SPDO_timeout>100</implied_SPDO_timeout> 

1. Back to FortiClient and perform 'Restore', choose the modified XML configuration file, enter 'password', and select 'OK'.
   
   

    

2. FortiClient will prompt that the 'Configuration restored successfully'.
   
   
   

    

3. To make the same change for endpoints managed through FortiClient EMS, access 'FortiClient EMS' -> 'Endpoint Profiles' -> 'Remote Access'.
   
   

4. Find the VPN profile that is in use on the endpoints and select 'Edit'.
   
   

    

5. On the screen that opens, select XML and then 'Edit' at the bottom center of the screen.
   
   

   

    

6. The editing screen will open. Look for the XML tags and edit them as shown in step 4.
   
   

  

Related document: 

IKE settings