IPsec Remote Access Can't Ping

Question

I've got a user whose IPsec Remote Access VPN won't ping out when connected. It can access a file server via IP address (despite failing to ping it), but it's not able to get DNS, nor can I ping the DNS server or anything external.

The FortiGate is a 90G on 7.4.12, using the latest FortiClient VPN Only version (7.4.3.8758). There are a dozen or so other users currently using the same VPN connection, and I've confirmed that the policies haven't changed.

As soon as we disconnect VPN, normal web traffic resumes, including the ability to ping.

Any ideas?

Toshi_Esumi · Answer

As described in the release notes, .8758 hotfix version was released Dec. last year, while .4726 GA was re-released in March this year. I would suggest you uninstall the current version and re-install the latest .4726 for this particular non-working client then try again (You didn’t mention if all the other clients with the same version were working or not working).
https://docs.fortinet.com/document/forticlient/7.4.3/windows-release-notes/683433/special-notices#:~:text=the%20FortiClient%20GUI.-,FortiClient%20(Windows)%207.4.3%20GA%20hotfix%201,-FortiClient%20(Windows

Then if it’s still not working as you expect, I would check below:
1. Client machine’s routing table (“route print” if Windows) to see if it pulled the proper route(s) (you didn’t mention if this is a split tunnel or non-split)
2. check client machine’s DNS settings (“ipconfig /all” if Windows) (you didn’t mention the client machine should use local DNS or DNS pulled over the tunnel)
Then if they’re correct, now it’s the time you need to sniff at the FGT if the client access over the tunnel is actually coming into the FGT, or not. Depending on that, the problem is either on the FGT side or on the client side. You need to isolate the problem first.

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO