IPSec VPN Unable to Connect

Forum|Forum|2 years ago
August 24, 2023
4 replies
8182 views

I have a Fortigate 60E running 6.2.15 that my remote MacBook Pro users connect to via FortiClient. I typically install the "FortiClientVPNSetup" version of the installer, because we don't use FortiClient for anything else – just VPN. When I installed the latest 7.2 release for a new user and did the config, the user was unable to connect – FortiClient would just show "Connecting" forever. Clicking the Disconnect button did nothing.

After a lot of troubleshooting, I uninstalled FortiClient and reinstalled using the full FortiClient installer instead of just VPN. Once that was installed and configured, it worked. Any ideas why the VPNSetup would fail to connect while the full FortiClient would work?

FortiClient

robin98

New Member

The newest version. 4.19.4 I believe? Yes, keep alive is on. I need to check their firewall. Im starting to think it's their router/modem, because the log for the client starts by saying this device is behind a NAT. I'm going to troubleshoot more tonight and I'll update once I have some more details.

kvimaladevi

Staff

Hi cdoggyd,

The Forticlient VPN setup version should also get connected without issues but as you say it is stuck in the connecting phase, we will have to check the forticlient logs and the sslvpnd logs by reproducing the issue to understand the reason.

How to enable forticlient logs:

https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-enable-debug-log-in-FortiClient/ta-p/190433

SSLVPN logs:

diag debug reset
diag vpn ssl debug-filter clear
diag vpn ssl debug-filter src-addr4 <client public IP>
diag debug app sslvpn -1
diag debug app fnbamd -1
diag debug console timestamp en
diag debug en

% connect to VPN from test user having issues %

To disable :
diag debug disable

Regards,

Vimala