SSL VPN client download being redirected

Question

I have noticed that recently installed Fortigate 30E and 60E devices with SSL VPN configured are redirecting FortiClient downloads to https://forticlient.com/#downloads when selecting either the MacOSx or Windows installer from the Fortigate SSL VPN web portal. This is a change from earlier behavior that downloaded the client directly from the firewall. The behavior is the same regardless of browser used or OS. I've also seen it behave in this manner in FortiOS 6.0.5 and 6.0.6, although it does not seem to occur in 6.2.0 versions.

I've confirmed the option to allow FortiClient download is enabled. No custom download location is specified of course, since I want the download to come from the firewall. The config is pretty basic, as seen below.

config vpn ssl settings set servercert "WC2020_pfx12" set idle-timeout 7200 set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1" set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1" set dns-server1 192.168.1.15 set dns-server2 8.8.8.8 set port 443 set source-interface "wan1" set source-address "all" set source-address6 "all" set default-portal "tunnel-access" end

config vpn ssl web portal edit "tunnel-access" set tunnel-mode enable set ipv6-tunnel-mode enable set save-password enable set ip-pools "SSLVPN_TUNNEL_ADDR1" set ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1" config split-dns edit 1 set domains "<removed>" set dns-server1 192.168.1.15 next end next end

config firewall policy edit 4 set name "SSL VPN Access" set uuid 48ef2084-fdad-51e9-b877-f079e3157c23 set srcintf "ssl.root" set dstintf "internal" set srcaddr "SSLVPN_TUNNEL_ADDR1" set dstaddr "Office LAN" set action accept set schedule "always" set service "ALL" set groups "tacacs_group" "SSL VPN Users" next end

Have others experienced similar behavior? I have an open ticket going with support, but they have indicated they cannot reproduce the behavior in their lab environments. Any help the community might offer on this would be most appreciated. Thanks for taking the time to look.

Michael_Runyon · Answer

Can anyone help with this? The issue persists. I have some further details now.

The problem is only present in firmware versions in the 6.0 subset, although it occurs within any of these version. Version 6.2 does not have this issue.

The "free" 6.2 Forticlient downloaded from the website does not allow for the usage of some advanced features. For example, "always up" (SSL VPN Keep Alives) cannot be used on the unsupported free client.

I have a ticket open with Fortinet support, but they have been unable to offer an explanation, or even reproduce the issue, which is very strange since I can demonstrate it on multiple operating systems and browsers, across multiple firewalls.

Please let me know if anyone has any insight as to what might be causing this issue.

Sign up

Login with SSO

Login to the community

Login with SSO