FortiEMS and AutoConnect/AlwaysUP
Hi Team,
So I have a case with TAC that is hitting the wall in the last 2 weeks. I have a client with 800 users , Fortigate and FortiEMS.
The main reason that he purchased FortiEMS is to have the users always connected and to be able to control which user can disconnect or not).
The problem is that even everything looks just fine, has the proper configuration from all the possible documentations, the auto-connect is not working! Not to speak about "user
EMS:
<options>
<allow_personal_vpns>0</allow_personal_vpns>
<certs_require_keyspec>0</certs_require_keyspec>
<on_os_start_connect_has_priority>0</on_os_start_connect_has_priority>
<keep_running_max_tries>0</keep_running_max_tries>
<autoconnect_only_when_offnet>0</autoconnect_only_when_offnet>
<disable_connect_disconnect>1</disable_connect_disconnect>
<secure_remote_access>1</secure_remote_access>
<show_vpn_before_logon>0</show_vpn_before_logon>
<show_negotiation_wnd>1</show_negotiation_wnd>
<on_os_start_connect/>
<autoconnect_on_install>1</autoconnect_on_install>
<suppress_vpn_notification>0</suppress_vpn_notification>
<use_windows_credentials>1</use_windows_credentials>
<minimize_window_on_connect>0</minimize_window_on_connect>
<use_legacy_vpn_before_logon>0</use_legacy_vpn_before_logon>
<after_logon_saml_auth>0</after_logon_saml_auth>
<current_connection_name>vpn.gw</current_connection_name>
<current_connection_type>ipsec</current_connection_type>
<autoconnect_tunnel>vpn.gw</autoconnect_tunnel>
Fortigate:
config vpn ipsec phase1-interface
edit "VPN"
set xauthtype auto
set save-password enable
set client-auto-negotiate enable
set dpd-retryinterval 60
next
Nothing works!
Client is pushed with SCCM, after installation it connects to EMS , policy is fetched, Remote Access tab appears but user has to enter username and password :) After that, if the network card is disconnected and EMS goes down, upon restoration EMS connects back, fetches the policy but again Remote Access requires password to connect.
To be honest I'm out of any ideas. Any help will be really appreciated.