Troubleshooting Tip: How to resolve the error 'send arp failed, err: 87'

Description

This article describes how to confirm and fix ARP error code '87'.

Scope

FortiClient, FortiGate.

Solution

When this issue is encountered, the endpoint connects to SSL VPN without any issues, but the end user loses connection to internal resources 5 to 10 seconds later despite the VPN still being connected.

The FortiClient FortiESNAC log shows the following error:

[15592:15588] [FortiESNAC 276 info] Processing adapter [40, Fortinet SSL VPN Virtual Ethernet Adapter, {FC7E3541-6F33-411C-8623-597237EB4301}]...
[15592:15588] [FortiESNAC 290 info] Processing ip address [10.55.155.1]
[15592:15588] [FortiESNAC 320 error] Ignore ip-gateway pair [10.55.155.1, 0.0.0.0], because send arp failed, err: 87

Checking the routing table on the endpoint reveals the following:

There are about 500+ routes in the routing table. Windows 11 only supports around 300 routes. After injecting 200+ routes, the issue is resolved.

 
Alternatively, implement a Routing Address Override on the SSL VPN profile to overcome this issue.

Make the following changes on the FortiGate SSL VPN portal: