Slow IPSec Connection with EMS Agent (25 Seconds) - VPN only agent 6 Seconds

Hello jh68782, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Hi again jh68782,

I found this answer, can you tell us if it helps, please?

Issue Summary

You are experiencing a delay in the IPsec VPN connection when using FortiClient EMS-managed clients compared to VPN-only clients. The connection takes approximately 25 seconds with EMS-managed clients, while it takes only 6 seconds with VPN-only clients. The delay seems to occur after the IKE negotiation, which completes in about 1 second, but the tunnel is only reported as "ready" 21 seconds later.

Observations

1. IKE Negotiation: The IKE negotiation itself is quick, taking about 1 second.
2. Delay: There is a significant delay (~21 seconds) after the IKE negotiation before the tunnel is reported as "ready."
3. EMS Management: The issue is specific to EMS-managed clients, as manually configured IPsec connections do not exhibit this delay.
4. Network Monitoring: Logs indicate that the delay might be related to network monitoring and public IP checks, which are causing the VPN interface to wait for stability before proceeding.

Attempts Made

• Configured user settings to always authenticate on demand.
• Enabled client auto-negotiate and keep-alive.
• Created VIP and policy to allow traffic from the public WAN to EMS port 8013, ensuring EMS is reachable.

Potential Causes

• Fabric Status Check: The delay might be due to the FortiClient waiting for EPC fabric status from FortiESNAC before completing the tunnel setup.
• Network Stability Checks: The logs suggest that network stability checks and public IP updates are contributing to the delay.

Recommendations

1. Review EMS Configuration: Check if there are any specific settings in EMS that might be causing the delay, particularly related to endpoint control or fabric status checks.
2. Network Monitoring Settings: Investigate the network monitoring settings to see if the frequency or conditions for public IP checks can be adjusted to reduce the delay.
3. FortiClient Logs: Analyze FortiClient logs in more detail to identify any additional factors contributing to the delay.
4. FortiGate Configuration: Although the FortiGate configuration is not directly involved, ensure that there are no policies or settings that might indirectly affect the EMS-managed clients.

Follow-ups and Clarification Questions

• Have you checked if there are any specific EMS policies or configurations that might be causing the delay?
• Can you provide more details on the network monitoring settings and any custom configurations applied?
• Are there any differences in the network environment or client configurations between the EMS-managed and VPN-only clients?
• Have you tried updating to the latest versions of FortiClient EMS and FortiClient to see if the issue persists?

Are there any security/filtering features on the full version of FortiClient? And are there any 3d party security solutions installed on the endpoint? If yes, then security solutions register filtering drivers into the networking stack which may increase the time it takes to process the traffic through the stack.