Connect to IPSec VPN with 2FA when connected through Teamviewer/Anydesk

Hi Team,

This is the default behavior of forticlient.

When you are connecting to forticlient VPN through IPSEC, only port 4500 and 500 will be open and rest of the ports will be closed.

So if you are running any anydesk or teamvieer which run through internet they will be disconnected. To modify the default behavior:

Step 1:

Open FCT, navigate to settings, create a backup of the configuration and make a copy of this file as we will be making some changes.


Step 2:

Edit the XML file > Search for the IPSEC section with keyword <implied_SPDO> for the ISPEC profile that you used and edit the following highlighted value then save the XML file.

Change the <implied_SPDO> to "1" and the <implied_SPDO_timeout> to "60", the value is in second and 60 seconds should be sufficient for the PC to receive the OTP Email before the timeout to block other traffic than the IPSEC traffic. In case the PC takes more than 60 seconds to receive the OTP then you must increase the value from 60 to a higher value.

Once the value is set, save the configuration and restore the config to the FCT. Test it with one user PC and let us know if you face any issues.

For your Reference: https://docs.fortinet.com/document/forticlient/6.2.1/xml-reference-guide/96295/ike-settings