Troubleshooting Tip: VPN failed to connect with error 'VPN blocked, please contact IT administrator' display

The FortiClient VPN getting this message because the EMS has enabled the features to block 'Configuring a profile to allow or block endpoint from VPN tunnel connection based on the applied security posture tag' under the remote access endpoint profile.

More details available there:
Configuring a profile to allow or block endpoint from VPN tunnel connection based on the applied Zero Trust tag

Sample message:

This message is the default message, however, it can be customized, for example:

To resolve this:

Ensure the endpoint device matches and satisfies (depending on the criteria tag that the EMS administrator chooses)  the tagging that is assigned under the VPN profile.

The criteria rule can be checked under the zero trust tag.

This check is executed only if the option 'Enable Secure Remote Access' is enabled on the Remote Access profile.