Skip to main content
wolfee
wolfee
New Member
May 12, 2016
Question

"Unable to establish the VPN connection. The VPN server may be unreachable." (-5) or (-9)

  • May 12, 2016
  • 1 reply
  • 19418 views

Myself and 3 other remote users for a gov't contract have been unable to connect our FortiClient VPN software since April 25th. (18 days and counting)  The gov't owns the software (serial number) and they have their own all-encompassing ticket but obviously that isn't progressing very fast.  We need to work.  Any help appreciated.  Everything I read online about this error points to adjusting the MTU.  I've run the following commands on both my gov't issued laptop as well as my own PC both on the same network (Comcast):

 

(gov't laptop) netsh interface ipv4 show subinterface

<returned value for Local Area Connection> MTU=1400

(my own PC) returns MTU=1500

 

From what I've read, the goal is to get a ping that is not "Fragmented but DF set."

(gov't laptop) ping <ip address> -f -l <value> RESULTS:

1372 and below= "Request timed out"

1374 and above= "Packet needs to be fragmented but DF set."

(my own PC) RESULTS:

1472 and below= "Request timed out"

1474 and above= "Packet needs to be fragmented but DF set."

 

There is no value on either machine that does not get fragmented or timed out.

I gave this info to those that are working the issue on the gov't side but like I said, they don't seem to understand how serious this is to our contract.  Any help/advice greatly appreciated.

    1 reply

    wolfee
    wolfeeAuthor
    New Member
    May 14, 2016

    In case anyone else has this problem, we use GFE laptops (gov't provided, no admin rights) and work remotely.  The problem seems to be receiving the group policy updates as well as the McAfee HBSS updates.  If you work remotely, even if you connect to the network providing the updates, it hasn't been updating automatically.  You have to run the updates yourself, so VPN into the network that provides the updates (Juniper Secure VPN).

    For group policy settings/updates: "gpupdate /force"

    For McAfee HBSS updates: right-click on the McAfee Icon on your task bar and select "update security".  Once that is done, right-click the McAfee Icon again and select "McAfee Agent Status Monitor...".  There will be seven buttons along the right side, you're interested in the top four.  By clicking the first button (Collect and Send Props), it should proceed through the first four buttons automatically but some people had to do it manually.  After that was done, I have been able to connect to our servers using FortiClient.  Hopefully it's resolved but I'll update if the problem returns.

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    May 16, 2016

    FWIW I've had the exact same error message on a FG-200B running v4.3.18. Debugging and sniffing didn't help, there was nothing to be seen.

    A simple reboot of the cluster solved this instantly. Uptime before was 197 days.

    dphills
    dphills
    New Member
    October 27, 2016

    I am having the same issue.  We have figured out that if we go into our internet options and click on the advance tab to reset the browser, we can then login via the FortiClient.  However, we have to do this quite often.  Does anyone know why the FortiClient is tied into Internet Explorer and how it can be bypassed?

    Terms & ConditionsAccessibility statement