Forticlient Certificates and OFF-Net behaviour.

Hi Guys, I am new to the forums. During the last weeks we have installed a Fortigate Cluster. (for the first time, I admit in the beginning.)

I wish to find some exchange on some ideas we expect to do with Forticlient and some "Yes" or "No's" from the experienced users.

Certificate Authentication (+other credentials)

Is there any experience in authenticating via IPSec with a computer certificate, issued from the Windows Domain (via GPO)?

(It is working for us with User Certificates, no success for the computer certificate)

Forticlient Off-Net behaviour

What is the intended behaviour for Forticlient: "Auto-connect when Off-Net: This option allows the FortiClient to autoconnect to a VPN even when it has an off-net status." (from the product description)

Would this block traffic other than to the VPN Site? This is what I would like to achieve, any experience in a similar setup?

Thanks for sharing your thoughts.

Regards,

Darius

Environment: FortiOS  5.24 + Forticlient 5.24 Windows 2012 Domain, Windows Clients.