Skip to main content
rpoon
rpoon
New Member
July 13, 2021
Solved

IPv6 causing SSL VPN connection issue

  • July 13, 2021
  • 3 replies
  • 52628 views

We used to have FortiClient version 6.2.6 and it works well on SSL VPN connection to our corporate network (gateway FortiOS version 6.4.3).  Once we upgraded to FortiClient 6.4.3, we start getting intermittent connectivity issue in that user cannot access network resources due to DNS resolution failure.  It's found to be caused by client's network interface attempts to query DNS through IPv6 and failed.  It then stop there without attempting querying IPv4 DNS.  We are stuck with no solution from Fortigate and desperately need to resolve it.  Does anyone encounter similar issue and can share some ideas?

 

Thanks

    Best answer by isamt

    So far we have not encountered any issues with IPv6 enabled home users, however it was only a small percentage of our users that have IPv6 enabled Internet connections so can't say for 100% certainty yet.

     

    FortiClient is independent of the Fortigate firmware version so yes you need EMS 7.0 or later and you may need to convert your EMS licences to version 6.4 at least then other than that you can upgrade your clients to 7.0 so not a lot of work at all.

    3 replies

    isamt
    isamt
    New Member
    August 17, 2021

    I have encountered the same issue.

    Resolutions was to disable IPV6 on the network adaptor at the client end.

     

     

    rpoon
    rpoonAuthor
    New Member
    August 17, 2021

    Unfortunately, Fortinet team seems uninterested in providing a viable solution to the issue.  We have over 1000 clients and need a centrally managed deployment of the solution.  Also concern if disabling IPv6 on the client may cause any other issue that we are not aware of.

      isamt
      isamt
      New Member
      August 17, 2021

      Your best option is to upgrade to FortiClient 7.0.0 or 7.0.1 which support dual stack IPv4 and IPv6

       

      I'm currently upgrading users to 7.0.0 which is significantly better than the previous versions of the client.

       

      PiLoos-itsec-consulting
      PiLoos-itsec-consulting
      New Member
      February 2, 2023

      We had exactly the same problem with FortiClient 7.0.7, but only if the laptop accesses the Internet via a mobile network: The mobile providers (in Germany) only use IPv6 to transport the data, which is why DNS queries are answered back with an IPv6 address. Thus, the FortiClient sends its SSL VPN requests to an IPv6 address. However, when the IPv6 packets leave the mobile network, the providers uses a 6to4-gateway - so the connection is converted to IPv4 . This seems to cause problems with the SSL VPN: FortiClient thinks it is establishing a connection to an IPv6 destination, but it is in fact IPv4. I can't explain why the problem occurs - I also assumed that it shouldn't matter, because normal surfing works over the same path without any problems.

       

      The solution of the issue can be solved much easier than described here or otherwise (IPv6 does not need to be disabled in Windows and no Windows registry changes need to be made):
      What you need to know: Before a host starts a DNS lookup, it always looks locally into the hosts file:

      1. First local hosts lookup
      2. Then DNS lookup

      (You can reverse this behavior - but it's "out of scope" here).
      Therefore, if you write into your local hosts file the IPv4 address and FQDN of your SSL VPN, the host always resolves IPv4 for that FQDN! We had no more IPv6 problems after configuring the local hosts.

       

      The hosts file can be found
      - under Windows: C:\Windows\System32\drivers\etc\hosts
      - under Linux/MacOs: /etc/hosts

       

      Cheers, Pi

      Gunna
      Gunna
      New Member
      January 31, 2024

      Managing via host files is a terrible idea, its a short term solution and doesn't scale with users or corporate infrastructure.

       

      If the user's home network assigns both IPv6 and iPv4 address windows will preference the IPv6.

      This causes a headache for DNS resolution to the corporate environment so instead a simpler solution that scales is to push the registry config via Intune\GPO to tell the client to ensure IPv4 is the preferred protocol.

      Vincent_RLG
      Vincent_RLG
      New Member
      February 1, 2024

      I was encountering the same type of issues. Like 90% of all issues, it came from DNS resolution who was made in IPv6 prior to IPv4. As we don't use IPv6 internally, clients with IPv6 enabled internet connections where unable to resolve internal names, because they were querying their Internet provider instead of the one pushed through the VPN connection.

      Workarounds are:

      - https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-Issues-with-resolving-the-internal-FQDN-when/ta-p/291062

      or

      - Disable IPv6 on the Client interface connecting to Internet or generally

      or

      - having a full dual stack infrastructure.

      I wonder if there isn't already a solution mixing IPv6 DNS-Database , "private" IPv6 and 6to4....

       

      Cheers

        sklotz
        sklotz
        Explorer
        September 23, 2025

        Thank you Vincent for this useful information.
        As this is a client/windows issue, it will help us also with a Checkpoint FW, where we encounter the exact same issue and behavior.
        As of now we just tested the disable IPv6 option on the WLAN-adapter, but the Enable SMHNR sounds little bit better as a general solution.
        Thank you!

        Regards,
        Stefan

          Terms & ConditionsAccessibility statement