FortiClient IPSec VPN fails with “IKE negotiation failed” on EMS-managed client but works on standalone client

The trap is the phrase "the same IPSec configuration file." The managed client does not use that file. It uses whatever EMS pushed to this endpoint, and which profile this endpoint receives depends on its EMS group assignment. "Other colleagues on the same version connect" does not mean they sit on the same profile or in the same endpoint group. The most common version of this exact symptom is that this one endpoint landed in a different or stale EMS profile whose phase1 settings don't match the gateway, while the colleagues are in the correct one.

Stop guessing and read the negotiation. "IKE negotiation failed" is a generic banner. Two things give you the real cause in minutes:

• On the FortiGate: diag debug reset, diag vpn ike log-filter rem-addr4 <client_public_ip>, diag debug application ike -1, diag debug enable. Connect and watch phase1. It will state exactly what failed: no proposal chosen, peer ID mismatch, PSK mismatch, or IKE v1/v2 mismatch.
• On the client: raise FortiClient VPN logging to debug and pull the same negotiation from the endpoint side.

With the debug running, check these specifically:

1. Diff the EMS-pushed phase1 against the working file attribute by attribute: IKE version, encryption/auth proposals, DH group, authentication method (PSK vs certificate), and local/peer ID. IKE failing means the mismatch is in phase1, and one of these will differ.
2. Confirm which EMS profile this endpoint is actually assigned and compare it to a working colleague's profile. This is where it usually breaks.
3. The managed full client carries modules the free VPN-only client lacks (FortiClient firewall / endpoint policy). One of those can block or mangle UDP 500/4500 on this specific machine while the free client, not having them, negotiates cleanly. Test with those modules disabled, or via a profile that disables them, to rule it in or out.
4. Rule out a stale or duplicate local tunnel left from a prior install. A clean reinstall of the managed client after clearing local FortiClient config clears this class of issue.

Bottom line: this is not the NIC and not the gateway. It is either the EMS profile this endpoint is receiving, most likely, or a managed-client module interfering with IKE, next most likely. The FortiGate IKE debug filtered to this user points straight at which one, so run that before you change anything.

are you using the same version 7.0.14 for the VPN-only FCT or other one?

Hi DW

Do you mean it works with FCT VPN (free version) 7.4.3 or 7.0.14?

In case it works with 7.4.3, then please try with FCT VPN 7.0.14 and tell us if it works. The idea here is to check if the version has something to do with the issue.