Mismatch between FortiClient VPN connection and Mac OS setting

[nedahejazi]

Hello,

 I installed FortiClient on MacOS 26.1 and after following the instruction from our IT, I am apparently connected to the VPN. Everything seems fine in the FortiClient window, showing it is "connected", but I have two problems: first in the Mac system setting, VPN & Filters, it shows VPN is "disconnected", second I lose the internet after connecting to the VPN. In the same system setting, under Filters & Proxies, I cannot add FortiClient to the list, while I can still see Cisco Secure. I checked some posts regarding  internet disconnection, but all are confusing to me and have not been helpful. I would be thankful if anyone would help to solve this issue.

Thank you.

[funkylicious · Accepted solution]

according to the "netstat -rn" table, you VPN pushes/installs a route for 10.11.42.0/24 network via utun interface and the IP assigned to you is 10.254.0.219 , which means it's split tunnel.

as for DNS settings/servers, these usually are assigned via DHCP from your home/local network when you connect to it, no need to change/set anything manually and based on the scutils --dns you can reach 8.8.8.8 therefore you should have internet access.

[nedahejazi]

 I cannot turn it on. Any help would be very welcome.

[funkylicious]

hi,

macOS user here. in System Settings > VPN you cannot connect to the VPN, only disconnect. Use FortiClient for connecting.

as for losing Internet after connection, make sure that the issue isnt just related to DNS and try pinging 8.8.8.8 after connecting and see if it works, then try google.com.

if dns resolution isnt working look into /etc/resolv.conf to see if FortiClient pushed any servers and if you have access to them to resolve the queries ( either using ping and/or nslookup ) .

also, check with netstat -rn if the vpn is configured as split-tunnel where you have access only to certain subnets or full-tunnel. if its full then IT needs to check if you are granted Internet access.

L.E. https://docs.fortinet.com/document/forticlient/7.4.3/macos-release-notes/223986

L.E.2 it appears that Tahoe/26.1 isnt oficially supported yet https://docs.fortinet.com/document/forticlient/7.4.3/macos-release-notes/471180 

[nedahejazi]

Dear Funkylicious, 

Thank you so much for your reply, I greatly appreciate your help. So sorry for my long reply. I am going through your possible solutions step by step.

-First I changed DNS servers to 8.8.8..8

But the problem remains. 

---------------------------

I then tried: "/etc/resolv.conf", showing this:

---------------------------

Next, I tried "scutil --dns" as suggested above, showing below:

 

But I do not understand it, I am not sure if I should check above suggested domains in "Search Domains" in the DNS setting.

---------------------------

I then checked for split-tunnel/full-tunnel using "netstat -rn" and I do not know if my IP address is changed to the VPN's IP address after VPN connection. Below is a part of the result after connection:

---------------------------

I do not know if I have done your suggestions perfectly. Perhaps this very last Mac OS version is not supported yet and I have to try with older versions. I would really appreciate it if you would share your points with me.

[funkylicious · Accepted solution]

according to the "netstat -rn" table, you VPN pushes/installs a route for 10.11.42.0/24 network via utun interface and the IP assigned to you is 10.254.0.219 , which means it's split tunnel.

as for DNS settings/servers, these usually are assigned via DHCP from your home/local network when you connect to it, no need to change/set anything manually and based on the scutils --dns you can reach 8.8.8.8 therefore you should have internet access.

[nedahejazi]

Great, so I have to ask IT about it and check with another version of Mac. Thank you again for your time!

[funkylicious]

may I ask what doesnt work after you connect to the VPN ?

all things should indicate that Internet access is/should be possible while connected to the VPN.

[nedahejazi]

After I connect to VPN, my internet seems to be extremely slow and nothing shows up after a simple google search.

[funkylicious]

try doing a speedtest and see if your public IP ( whatsmyip.org ) changes before and after connecting to the VPN.

also, do a "time nslookup google.com" before and after to measure how long it takes to resolve.

[nedahejazi]

I have tried "whatsmyip.org". This is before:

 

And this is after!

After VPN connection, my internet goes to zero.