Troubleshooting Tip: Fix 'Unable to connect to VPN because tunnel configuration is unsupported' error for dial-up IPsec connections

When connecting to a dial-up IPsec VPN tunnel from a MacOS device, the following error may be encountered:

This error is because FortiClient on MacOS does not support DH group values above 18 for IKEv1 configurations. For FortiClient version 7.4.2, the default DH group value is 20, which is unsupported for MacOS.

To resolve this, a value of 18 or lower simply needs to be chosen. An example is provided below.

On FortiClient, navigate to Remote Access, then edit the connection using the icon  beside the VPN Name. Next, select VPN Settings and expand Phase 1 and Phase 2 to make the changes similar to the image below.

In FortiClient version 7.4.3, the default has been set to DH group 5 for IKEv1 to avoid this issue.

Note: In some cases, even if FortiClient settings are already updated, it will still use the old configuration due to FortiClient configuration cache. When this happens, create or add a new VPN connection on FortiClient to make sure that the new configuration is applied.

On FortiClient, navigate to Remote Access, then Add new connection