| Post upgrade of FortiGate to FortiOS version 7.6.5, connections from FortiClient VPN Android fail. This issue is only affecting FortiClient VPN Android. 
The error below ('FCT-UID parsing error') is observed while running IKE debugs. diagnose vpn ike log filter rem-addr4 x.x.x.x <----- Replace x.x.x.x with the remote client Public IP.
diagnose debug application ike -1
diagnose debug console timestamp enable
diagnose debug enable ike V=root:0:For_android_0:1:13: FCC request len = 225, data = 'VER=1
FCTVER=FortiClient_Android_v7.4.3.0185
UID=156C5C5B58525B545D5A0007980B552549383254795333756E6B6E6F776E5698
IP=192.168.0.20
HOST=localhost
USER=fortinet
OSVER=Android Linux 6.1.57-android14-11-g792270e27ab1-ab11683491'
ike V=root:0:For_android_0:1: FCT-UID parsing error
ike V=root:0:For_android_0:1:13: peer proposal is: peer:0:10.0.1.10-10.0.1.10:0, me:0:0.0.0.0-255.255.255.255:0 ike V=root:0:VPN_0:247:VPN:1827: trying
ike V=root:0:VPN_0:247:VPN:1827: matched phase2
ike V=root:0:VPN_0:247:VPN:1827: dynamic client
ike V=root:0:VPN_0:247:VPN:1827: my proposal:
ike V=root:0:VPN_0:247:VPN:1827: proposal id = 1:
ike V=root:0:VPN_0:247:VPN:1827: protocol id = IPSEC_ESP:
ike V=root:0:VPN_0:247:VPN:1827: PFS DH group = 2
ike V=root:0:VPN_0:247:VPN:1827: trans_id = ESP_AES_CBC (key_len = 128)
ike V=root:0:VPN_0:247:VPN:1827: encapsulation = ENCAPSULATION_MODE_TUNNEL
ike V=root:0:VPN_0:247:VPN:1827: type = AUTH_ALG, val=SHA1
ike V=root:0:VPN_0:247:VPN:1827: trans_id = ESP_3DES
ike V=root:0:VPN_0:247:VPN:1827: encapsulation = ENCAPSULATION_MODE_TUNNEL
ike V=root:0:VPN_0:247:VPN:1827: type = AUTH_ALG, val=SHA1
ike V=root:0:VPN_0:247:VPN:1827: incoming proposal:
ike V=root:0:VPN_0:247:VPN:1827: proposal id = 1:
ike V=root:0:VPN_0:247:VPN:1827: protocol id = IPSEC_ESP:
ike V=root:0:VPN_0:247:VPN:1827: PFS DH group = 2
ike V=root:0:VPN_0:247:VPN:1827: trans_id = ESP_AES_CBC (key_len = 128)
ike V=root:0:VPN_0:247:VPN:1827: encapsulation = UDP_ENCAPSULATION_MODE_TUNNEL_RFC3947
ike V=root:0:VPN_0:247:VPN:1827: type = AUTH_ALG, val=SHA1
ike V=root:0:VPN_0:247:VPN:1827: trans_id = ESP_AES_CBC (key_len = 128)
ike V=root:0:VPN_0:247:VPN:1827: encapsulation = UDP_ENCAPSULATION_MODE_TUNNEL_RFC3947
ike V=root:0:VPN_0:247:VPN:1827: type = AUTH_ALG, val=SHA1
ike V=root:0:VPN_0:247:VPN:1827: trans_id = ESP_3DES
ike V=root:0:VPN_0:247:VPN:1827: encapsulation = UDP_ENCAPSULATION_MODE_TUNNEL_RFC3947
ike V=root:0:VPN_0:247:VPN:1827: type = AUTH_ALG, val=SHA1
ike V=root:0:VPN_0:247:VPN:1827: trans_id = ESP_3DES
ike V=root:0:VPN_0:247:VPN:1827: encapsulation = UDP_ENCAPSULATION_MODE_TUNNEL_RFC3947
ike V=root:0:VPN_0:247:VPN:1827: type = AUTH_ALG, val=SHA1
ike V=root:0:VPN_0:247:VPN:1827: negotiation result
ike V=root:0:VPN_0:247:VPN:1827: proposal id = 1:
ike V=root:0:VPN_0:247:VPN:1827: protocol id = IPSEC_ESP:
ike V=root:0:VPN_0:247:VPN:1827: PFS DH group = 2
ike V=root:0:VPN_0:247:VPN:1827: trans_id = ESP_AES_CBC (key_len = 128)
ike V=root:0:VPN_0:247:VPN:1827: encapsulation = ENCAPSULATION_MODE_TUNNEL
ike V=root:0:VPN_0:247:VPN:1827: type = AUTH_ALG, val=SHA1
ike V=root:0:VPN_0:247:VPN:1827: set pfs=MODP1024
ike V=root:0:VPN_0:247:VPN:1827: using udp tunnel mode.
ike V=root:0: comes x.x.x.x:4500->x.x.x.x:4500,ifindex=28,vrf=0,len=112....
ike V=root:0: IKEv1 exchange=Informational id=xx/xx len=108 vrf=0
ike 0: in [hash]
ike 0:VPN_0:247: dec [hash]
ike V=root:0:VPN_0:247: notify msg received: R-U-THERE
ike 0:VPN_0:247: enc [hash]
ike 0:VPN_0:247: out [hash]
ike V=root:0:VPN_0:247: sent IKE msg (R-U-THERE-ACK): 203.106.166.5:4500->203.106.180.73:4500, len=92, vrf=0, id=xx/xx
ike V=root:0:VPN_0:247:VPN:1827: replay protection enabled
ike V=root:0:VPN_0:247:VPN:1827: SA life soft seconds=28785.
ike V=root:0:VPN_0:247:VPN:1827: SA life hard seconds=28800.
ike V=root:0:VPN_0:247:VPN:1827: IPsec SA selectors #src=1 #dst=1
ike V=root:0:VPN_0:247:VPN:1827: src 0 7 0:0.0.0.0-255.255.255.255:0
ike V=root:0:VPN_0:247:VPN:1827: dst 0 7 0:10.81.235.10-10.81.235.10:0
ike V=root:0:VPN_0:247:VPN:1827: add dynamic IPsec SA selectors 282
ike V=root:0:VPN_0:247:VPN:1827: added dynamic IPsec SA proxyids new 1 282
ike V=root:0:VPN:1827: add route 10.81.235.10/255.255.255.255 gw 203.106.180.73 oif VPN(34) metric 15 priority 1
ike V=root:0:VPN_0:247:VPN:1827: tunnel 7 of VDOM limit 0/0
ike V=root:0:VPN_0:247:VPN:1827: add IPsec SA: SPIs=1b6004fe/07a2ad69
ike 0:VPN_0:247:VPN:1827: IPsec SA dec spi 1b6004fe key [hash]
ike 0:VPN_0:247:VPN:1827: IPsec SA enc spi 07a2ad69 key [hash]
ike V=root:0:VPN_0:247:VPN:1827: added IPsec SA: SPIs=1b6004fe/07a2ad69
ike V=root:0:VPN_0:247:VPN:1827: sending SNMP tunnel UP trap
ike V=root:0:VPN_0: tunnel up event assigned address 10.81.235.10
ike V=root:0:VPN_0: EMS: FCT UID not ready The FortiGate reports a successful Phase 2 negotiation and an active tunnel, yet the FortiClient VPN on Android fails to establish the connection. Root cause: FortiOS v7.6.5 now validates and expects the length of the FortiClient UID to be 32 bytes. The issue is caused by FortiOS receiving a 64-byte UID from FortiClient Android; previous FortiOS versions truncated the longer FortiClient Android UID to ensure it was 32 bytes. From FortiOS v7.6.5 onward, this UID truncation is no longer done, which leads to the parsing error seen in the debugs. The issue is resolved in FortiClient Android 7.4.5, which is already available to download in the Google Play Store at FortiClient VPN. Workaround: Downgrade to FortiOS v7.6.4 and lower. Note: Windows FortiClient will be able to connect with the same VPN tunnel config with no error, but the FortiClient Android version will show an error message. FortiGate shows the tunnel is up and the IP is assigned to the client. 
Related article: Technical Tip: IPsec tunnels not connecting after upgrade to v7.6.5 | 
