When connected to a IPsec VPN full tunnel, all traffic should go through the IPsec VPN tunnel, but somehow internal traffic is going though LAN adapter, resulting in users unable to access internal resources.
When this happens, check if there is any third-party virtualization enabled in the affected endpoint.
After connecting to the VPN, open Windows command prompt, and run the following command:
ipconfig /all
route print
tracert -d example.companyName.com
Note: Replace 'example.companyname.com' with any internal website that is supposed to be reachable after connected to VPN.
Check if there is any 'VMware Ethernet Adapter' or 'VirtualBox Host-Only Ethernet Adapter', or any other VM adapter.
C:\>route print
===========================================================================
Interface List
73...........................Fortinet VPN-V Network Adapter
50...38 f3 ab 51 f9 65 ......Realtek PCIe GbE Family Controller #4
4...00 09 0f aa 00 01 ......Fortinet SSL VPN Virtual Ethernet Adapter
9...40 1c 83 a8 81 b3 ......Microsoft Wi-Fi Direct Virtual Adapter #7
47...42 1c 83 a8 81 b2 ......Microsoft Wi-Fi Direct Virtual Adapter #8
30...00 50 56 c0 00 01 ......VMware Virtual Ethernet Adapter for VMnet1
19...00 50 56 c0 00 08 ......VMware Virtual Ethernet Adapter for VMnet8
2...40 1c 83 a8 81 b2 ......Intel(R) Wi-Fi 6 AX201 160MHz #2
21...40 1c 83 a8 81 b6 ......Bluetooth Device (Personal Area Network) #6
1...........................Software Loopback Interface 1
The example above shows 'VMware Virtual Ethernet Adapter', which should be disabled.
Third-party virtualization adapters may conflict with the endpoint routing behavior when connected to IPsec VPN: they must be disabled for FortiClient routing to work properly.
Solution:
Open the Windows Network Connection page by going to Start -> type: ncpa.cpl -> Enter. Look for the third-party virtualization adapter, right-click it and select 'Disable'. Reconnect IPsec VPN in FortiClient. The routing should work properly now, and internal resources will be routed through the IPsec VPN tunnel and will be reachable.
| 
