Need FortiGate-side workaround: RDP disconnects when client FortiClient VPN connects on internal PCI have a FortiGate 40F running FortiOS 7.4.12.I need to RDP from outside the office to an internal Windows PC at 192.168.1.89. RDP works normally while the PC is not connected to a VPN.The issue is that the user must connect FortiClient VPN provided/configured by our client on the same Windows PC (192.168.1.89). As soon as the client FortiClient VPN connects, my existing RDP session disconnects.I have no control over the client's FortiClient configuration and cannot ask the client to change any settings on their side Basically, the IP is getting change after VPN is connected, what is the work around for this SSL VPN Already verified192.168.1.89 is reachable from the FortiGate. TCP 3389 is listening on 192.168.1.89. RDP works correctly before the client FortiClient VPN is connected. Once the client FortiClient VPN connects on 192.168.1.89, the RDP session disconnects. I also tested FortiGate SSL-VPN Web Mode RDP, but the RDP session still disconnects when the client FortiClient VPN connects on 192.168.1.89. Connected my Forgate vpn Client and accessed the machine Still same issue I cannot modify the client's FortiClient VPN profile/settings. I need both VPN connectivity and direct RDP access to work simultaneously.The requirement is that I should be able to establish a direct RDP session to the office PC, and then the user should be able to connect to the client-provided FortiClient VPN without the existing RDP session being disconnected.Either of the following workarounds would be helpful: Maintain the direct RDP session while the user connects to the client FortiClient VPN. Allow both VPN connectivity and RDP access to work simultaneously through a FortiGate-side configuration. I cannot make any changes to the client's FortiClient VPN configuration, so I am looking for a solution that can be implemented entirely on my FortiGate.

Explorer II

Question

VPN Connection Issue ( Urgent )

Forum|Forum|28 days ago
September 14, 2026
5 replies
174 views

Need FortiGate-side workaround: RDP disconnects when client FortiClient VPN connects on internal PC

I have a FortiGate 40F running FortiOS 7.4.12.

I need to RDP from outside the office to an internal Windows PC at 192.168.1.89. RDP works normally while the PC is not connected to a VPN.

The issue is that the user must connect FortiClient VPN provided/configured by our client on the same Windows PC (192.168.1.89). As soon as the client FortiClient VPN connects, my existing RDP session disconnects.

I have no control over the client's FortiClient configuration and cannot ask the client to change any settings on their side

Basically, the IP is getting change after VPN is connected, what is the work around for this SSL VPN

Already verified

192.168.1.89 is reachable from the FortiGate.
TCP 3389 is listening on 192.168.1.89.
RDP works correctly before the client FortiClient VPN is connected.
Once the client FortiClient VPN connects on 192.168.1.89, the RDP session disconnects.
I also tested FortiGate SSL-VPN Web Mode RDP, but the RDP session still disconnects when the client FortiClient VPN connects on 192.168.1.89.
Connected my Forgate vpn Client and accessed the machine Still same issue
I cannot modify the client's FortiClient VPN profile/settings.

I need both VPN connectivity and direct RDP access to work simultaneously.

The requirement is that I should be able to establish a direct RDP session to the office PC, and then the user should be able to connect to the client-provided FortiClient VPN without the existing RDP session being disconnected.

Either of the following workarounds would be helpful:

Maintain the direct RDP session while the user connects to the client FortiClient VPN.
Allow both VPN connectivity and RDP access to work simultaneously through a FortiGate-side configuration.

I cannot make any changes to the client's FortiClient VPN configuration, so I am looking for a solution that can be implemented entirely on my FortiGate.

osoleimani

Staff

Hi,

Based on the behavior described, the important point is that the disconnect occurs when the internal PC establishes a separate FortiClient VPN connection. At that point, the PC's own VPN/routing state can change, so the existing RDP session may no longer use the same network path.

Because that VPN connection is configured by the client and you do not control its FortiClient profile, there may not be a FortiGate-side configuration that can reliably preserve the existing RDP session.

SSL VPN documentation describes how tunnel/full-tunnel and split-tunnel configurations determine which traffic is routed through the VPN.

If the requirement is for the same PC to maintain an externally initiated RDP session while simultaneously connecting to another VPN, the key item to verify is how that client's VPN handles routing to the existing RDP peer. That behavior is ultimately controlled at the endpoint/VPN side.

Hope this helps clarify where the disconnect is occurring and which side of the connection controls the behavior.

eliaslatifAuthor

Explorer II

Hi, yes. The issue occurs because the office PCs are being accessed remotely via RDP, and those same PCs are also running FortiClient SSL VPN to connect to the client’s network.

When the FortiClient VPN establishes the tunnel, it changes the routing/interface configuration on the office PC. As a result, the existing RDP session loses connectivity because the return traffic is no longer routed through the original network path, causing the RDP session to disconnect.

The users are remote and need to RDP into their office PCs, while simultaneously using FortiClient VPN on those PCs to access the client network. Since we cannot make any changes to the client-side network configuration, I’m looking for a workaround that will maintain the RDP session while the FortiClient SSL VPN remains connected and operational.

funkylicious

SuperUser

when you connect the workstation to the VPN, does it install a default route or only certain routes? is the VPN an IPsec or SSLVPN connection ?

have you tried to enable NAT on the firewall policy that allows access from outside to the PC when you connect remote ?

"jack of all trades, master of none"

eliaslatifAuthor

Explorer II

Hi, thank you for your response. It’s an SSL VPN, and I haven’t tried enabling NAT on the policy yet. I’ll enable NAT and test it. I’ll let you know if that resolves the issue.

L

Louisowen2608

Explorer

The issue occurs because the client's FortiClient VPN establishes a default route or alters the routing table, breaking the return path for your direct RDP session. Since you lack administrative control over the client-side profile, you can implement the following workarounds to maintain connectivity:

Host-Based Static Route: Configure a persistent static route on the internal Windows PC to ensure that traffic destined for your remote management subnet explicitly prefers the local gateway.
Firewall Source NAT (SNAT): Enable SNAT on the inbound RDP firewall policy on the FortiGate to ensure return packets are correctly forced back through the physical interface.
Service Binding: Bind the RDP service on the host machine to the physical LAN interface IP, preventing it from attempting to respond via the virtual VPN adapter.

Need FortiGate-side workaround: RDP disconnects when client FortiClient VPN connects on internal PC

Already verified

Sign up

Login with SSO

Login to the community

Login with SSO