[Crash] ipsec.exe (0xc0000005) hangs after SAML Auth - FortiClient 7.4.3 - Dell/MediaTek

[orexes]

Hi Community,

I am reaching out because I am hitting a wall with a specific client installation and I suspect a hardware/driver conflict, but I need confirmation or ideas on how to debug this further.

The Scenario: I am deploying an IPsec VPN configuration with SAML Authentication (Entra ID / Azure AD).

• Success: The exact same configuration works perfectly on an HP PC.

• Failure: It fails consistently on a specific Dell Laptop.

Environment (Failing Machine):

• Hardware: Dell Laptop

• Network Adapter: MediaTek Wi-Fi 6E MT7922 (Wireless LAN Card)

• OS: Windows 10/11 [Please confirm your OS version here, e.g., 22H2]

• FortiClient Version: VPN-only Client 7.4.3 (Build 1790) / Hotfix 1.8758

The Symptoms:

1. The user starts the VPN connection.

2. SAML Authentication window pops up (Microsoft Entra ID).

3. Authentication is successful.

4. The Issue: Immediately after the auth window closes, the FortiClient status hangs (stalls). It does not establish the tunnel.

5. After a short moment, nothing happens, or the connection attempt simply vanishes.

Logs & Analysis: The internal FortiClient logs are unhelpful; they stop right after the SAML authentication confirms "success" and do not show the tunnel negotiation failure.

However, the Windows Event Viewer reveals that ipsec.exe is crashing silently with an Access Violation error (0xc0000005).

Event Viewer Output:

Plaintext

Faulting application name: ipsec.exe, version: 7.4.3.1790, time stamp: 0x67db4333
Faulting module name: ipsec.exe, version: 7.4.3.1790, time stamp: 0x67db4333
Exception code: 0xc0000005
Fault offset: 0x000000000003d812
Faulting process id: 0x2D7C
Faulting application path: C:\Program Files\Fortinet\FortiClient\ipsec.exe
Faulting module path: C:\Program Files\Fortinet\FortiClient\ipsec.exe

Troubleshooting steps taken so far: To rule out corruptions, I have performed the following steps, but the result remains the same:

• Clean Install: Used the FCRemove Tool to completely wipe the client before every re-installation.

• Versions: Tried multiple previous versions of FortiClient (7.2.x, 7.0.x) – same behavior.

• Dependencies: Reinstalled and tried different versions of Visual C++ Redistributables (vcredist).

• Permissions: Tested with both Local Administrator and Standard User accounts.

Hypothesis: Given that this works on an HP machine (likely Intel/Realtek Wi-Fi) but crashes on the Dell with the MediaTek Wi-Fi 6E MT7922, I suspect a conflict between the ipsec.exe process and the MediaTek network driver stack.

Has anyone experienced similar crashes with MediaTek adapters? Are there any known workarounds or specific driver settings (Offload settings) that need to be disabled?

Any help would be greatly appreciated.

Thanks!

[Jean-Philippe_P]

Hello orexes, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

[MarcH]

Hi orexes

We have the same issue but on various computers, all different NICs (Intel, Realtek, etc). There are a few known issues listed:

Bug ID: 

1102421 - IPsec VPN IKEv2 SAML-based authentication is unreliable.

1116375 - IPsec VPN IKEv2 with session resumption cannot switch between different Wi-Fi SSIDs.

1133715 - Unreliable connection establishment with IKEv2 over TCP.

https://docs.fortinet.com/document/forticlient/7.4.3/windows-release-notes/573433/new-known-issues