FortiClient update

I don' t think you can push FortiClient to the end-users without any interaction, since the FortiGate knows nothing about the local Administrator account details to install/update the software. If they can' t login due to incompatible FortiClient software, they can get the latest one from http://www.forticlient.com/ You can also create endpoint compliance policy with captive portal enabled for those who are using old clients. Devices without an up-to-date installation of FortiClient software would be restricted to a captive portal from which the user can download the latest FortiClient installer, but it' s up to them (or the Admin) to install the app. Another alternative is to enable the web portal access for SSL VPN users. It has the option to download FortiClient from the portal, whichever is available on your Fortigate at the time. They can then use that updated client to tunnel-in. Also the client should automatically update itself. Every now and then it connects to FortiGuard to download the latest signatures and engines. Not sure though if that' s normal that end users can' t login after FortiGate update. I' d suggest to log a support ticket to double check, there might be some other issues preventing them to access your LAN.

Upgrade FortiOS from what version to what version? And what was your old VPN setting look like?

I don' t remember off the top of my head, but I believe it was a 5.0.6->7 or 8