Client VPN bugs

[Fireshield]

I have a rather nasty issue facing me at the moment. Let me start with a bit of history... We have been using the FortiClient with static Virtual IP settings for over a year without issues. Within the last 2 months, the Fortinet Virtual Adapter started disappearing on many boxes. This would break our VPNs since we were relying on that adapter as a home for the Virtual IP. Being Fortinet has absolutely NO support for the FortiClient, our only option was to abandon using the Virtual IP and let the FortiGate see the actual PCs IP address. This caused a new problem - some of the clients are getting the same IP address from their local router (probably a standard config Linksys). Whenever one of these clients connect it boots the already connected client with that same IP address. So, my issue is how to do some form of NAT on these connections so it supports client hosts with the same IP address...and without using the VPN client settings to do it (remember, the Virtual Adapter is missing). Anyone else had similar results or a direction I might look in to get this resolved?

[rwpatterson]

I' ve not used Forticlient, but if it requires groups to connect, then assign each user into a different group, assign each one user group into a different policy, and NAT each policy into a unique IP pool address. I know, a bunch of work, but if it' s all ya got to work with. . .

[Fireshield]

One you select IPSec as your action on a policy the IP Pool feature is gone. I' ve tried Inbound NAT but that didn' t change anything. People would still get bumped when another with the same IP connected.

[rwpatterson]

Yeah, I see now. Your best bet would be to try to get that virtual adapter installed again. Good luck.

[Fireshield]

If only it were that easy. Removing and reinstalling the client or a full repair doesn' t bring back the client. The only ' fix' is to rip out all networking AND MS TCP/IP, reboot to let windows rediscover and repair and then install the client. This won' t work for the numbers of already broken clients out there. So, anyone know of another VPN client that works with the Fortigate?

[rwpatterson]

I just had a problem where the thumbnail images weren' t showing up in Windows 2000. I found a PC where it worked (XP), found the registry entry(s) involved, and saved them. I then imported the registry entries into the non-working workstations, and restored thumbnails that way. Would this be a possibility? Granted, there may be a bunch of entries, but once you narrow it down and create the file, it' s a simple import. That' s all I got. Good luck again.

[Fireshield]

I have considered a full registry hack as a solution. I' m still a bit away from having the time to lab if the adapter IDs are the same for all installs. If they are then this might help some. It' s on my list, just can' t make the top of it yet. I' m stuck with too much DST updating atm and a hard deadline on that.

[rwpatterson]

I hear that with both ears!

[vanc]

Fireshield, Which version of the client are you using? Can you check Windows Device Manager and see if the virtual adapter is hidden? Right click on " My Computer" and choose " Properties" , then switch to " Hardware" tab, click on " Device Manager" , Enable " Show hidden devices" from the View menu and expand " Network adapters" section. If there is not an entry called " Fortinet virtual adapter" , it' s really gone. Otherwise, the virtual adapter may be hidden. Another suggestion is to always enable the virtual adapter. In the new client releases starting from 3.0.308, the virtual adapter is hidden by default. The client will enable it if the adapter will be used. Frequent enabling/disabling the virtual adapter sometimes cause Windows to remove the device. There are two possible ways to add the virtual adapter back. Method 1. Go to Control Panel, click on " Add New Hardware" . A dialog will pop up, click on " Next" . Select " Yes, I have already connected the hardware" and click " Next" . There will be a list showing all the devices installed. If " Fortinet virtual adapter" is in the list, select it and continue. If it' s not in the list, use the second method. Method 2. 1) Launch FortiClient installer (the exe file). You don' t need to really install. When the " Welcome" page appears, leave the window there. 2) Launch Windows explorer, and switch to " c:\Documents and Settings\<your_current_user_name>\Local Settings\Temp\{C2FAE67B-9c91-4C88-91C6-37E4D5F50FE9}" directory. Please replace <your_current_user_name> with the user name you currently log on. 3) In that folder, you will find two files " ft_vnic.inf" and " ftvnic.sys" . Copy these two files to " c:\temp" directory. After copy done, you can close FortiClient installer. 4) Now launch " Add New Hardware" from control panel again. When the device list appears, scroll down to bottom and select " Add a new hardware device" , then click " Next" . In the next page, select " Install the hardware that I manually select from a list (Advanced)" , and click " Next" . In the device type list, select " Network adapters" and click " Next" . On the next page, click " Have Disk..." button. In the dialog, input " c:\temp" in the edit box and click on " OK" . The " Network Adapter" list will show " Fortinet virtual adapter" . Select it and click on " Next" . Ignore the warning window by clicking on " Continue anyway" . After a while, the adapter will be installed.

[Fireshield]

Great info Vanc! The FortiClient has had the adapter disappear from versions 2.0.262 thru and including 3.0.395, so it' s more than a ' latest version' issue. I' ll look into some of the other tips and see if we can get any progress. Thanks!