FORTICLIENT VPN - connection only possible with a different Internet provider

So, your partners VPN. Do you know if it is SSL or IPSEC? is yours IPSEC or SSL? If your company is using FortiClientEMS then this could be your issue depending on versioning. Please let us know the answer to my questions.

Hello,

Are you able to ping the SSL-VPN gateway from your computer or the WAN interface IP of the FortiGate device? (without connecting to VPN)

And also, what error message does FortiClient display when you are trying to connect the VPN?

Thank You

So with SSL VPN there's not going to be any port or protocol restriction that will be impacting the connection in the same way that an IPSEC VPN could be impacted... I'mm preface this with stating that in all my years of experience I'd say that 75% or more of all issues were related to name resolution issues and this may be no different... So you get the message: "Unable to establish the VPN connection. The VPN server may be unreachable". We need to now know the FQDN (somevpn.mycompany.com) of your VPN that you are trying to connect to and then attempt the connection with a browser since your VPN will use the same port (TCP 443) as your Chrome/Firefox/Edge/Etc. will use. If you have to connect back to the neighbors ISP to obtain the address do it, or you may be able to pull it up from within FortiClient itself but either way we need to know what URL you're connecting to.... Once you have that, it will be a downhill ride to determine what this issue is. Steps outlined below

1. Obtain the URL or FQDN of your VPN (I.E. vpn.fortinet.com)

2. Open the Run Dialog box by holding down the Windows Key and then pressing the letter "R".

3. In the run dialog box type: cmd and then hit OK or Enter

4. The black MSDOS style box is opened. Type: ping vpn.yourcompany.com

4a: If it says: "Ping request could not find host vpn.fortinet.com" come back here and post the results

4b: If it says anything else other than the the output in 4a, it does not matter, proceed to step 5.

5. Since you are using an SSL VPN, input the address from step 1 (the address you got Request Timed out or Reply From in step 4) into the address bar (not a search engine) of your browser and see if the page comes up.

If it does open and you see a page load that looks like your company, your ISP is fine and something is wrong that your IT department will need to get involved with to fix but my hunch is that on Step 4 you will be responding to us stating that the result was 4a and you got: "could not find host whatever.yourvpnisnamed.com"

Look forward to hearing back

EDIT:

I apologize that I missed that you could ping the IP of the remote VPN but only when connected to the neighbors WiFi - If you are talking IP then name resolution is not the issue so I gotta think that there is a policy that your home IP has somehow got added to a blacklist but either way if you're having issues with just one IP at your ISP then I'd try to get a new MAC address (besides your router) which should get you a new IP and then try it... If no go then about have to be looking at your ISP being on some sort of blacklist

I have seen similar behavior in the US with a different VPN service (Meraki). What we figured out was that the ISP (Comcast, in this case) was mistakenly flagging this traffic as malicious, so it was getting dropped.

A good way to check is to run a "traceroute" in each networking environment and compare.

Windows:

https://support.microsoft.com/en-us/topic/how-to-use-tracert-to-troubleshoot-tcp-ip-problems-in-windows-e643d72b-2f4f-cdd6-09a0-fd2989c7ca8e

Mac:

https://www.godaddy.com/help/performing-a-traceroute-in-mac-os-x-3366

The traceroute will tell you all of the servers your connection hops through on the way to reaching your company's VPN server. Naturally, the paths for both your and your neighbor's connection will be different, but what you'll want to confirm is if the traceroute is reaching the VPN or not, and at what point it gives up, if it does not reach the server.

I would start here, then engage your ISP for further help, since this may be much more complicated than just the router in your home.

Hope this helps.