FORTICLIENT VPN - connection only possible with a different Internet provider

[Maubet]

Dear Forum, 

I'm writing from Brussels/Belgium and here is my issue, and really hope you can help me. 

Since already more than a month I cannot connect to my VPN, my IT and my Internet provider have not been able to help me. 

As always one says is the VPN and the other says is the Internet/WIFI. In short, since around the 21/05 I'm not able to connect as usually meaning using my WIFI (TELENET), but once I switch to my neighbor's WIFI (PROXIMUS) I'm able to connect. 

My IT tried different things but nothing solved the issue, my Internet provider changed twice the modem and this didn't solve the problem. 

What's also strange is that my partner working from home is not having issues with his VPN (different company/network).

Do you perhaps have an idea of how to solve the problem? 

I look forward to hearing from you

Thanks in advance 

Maubet Davila 

[fcb]

So with SSL VPN there's not going to be any port or protocol restriction that will be impacting the connection in the same way that an IPSEC VPN could be impacted... I'mm preface this with stating that in all my years of experience I'd say that 75% or more of all issues were related to name resolution issues and this may be no different... So you get the message: "Unable to establish the VPN connection. The VPN server may be unreachable". We need to now know the FQDN (somevpn.mycompany.com) of your VPN that you are trying to connect to and then attempt the connection with a browser since your VPN will use the same port (TCP 443) as your Chrome/Firefox/Edge/Etc. will use. If you have to connect back to the neighbors ISP to obtain the address do it, or you may be able to pull it up from within FortiClient itself but either way we need to know what URL you're connecting to.... Once you have that, it will be a downhill ride to determine what this issue is. Steps outlined below

1. Obtain the URL or FQDN of your VPN (I.E. vpn.fortinet.com)

2. Open the Run Dialog box by holding down the Windows Key and then pressing the letter "R".

3. In the run dialog box type: cmd and then hit OK or Enter

4. The black MSDOS style box is opened. Type: ping vpn.yourcompany.com

4a: If it says: "Ping request could not find host vpn.fortinet.com" come back here and post the results

4b: If it says anything else other than the the output in 4a, it does not matter, proceed to step 5.

5. Since you are using an SSL VPN, input the address from step 1 (the address you got Request Timed out or Reply From in step 4) into the address bar (not a search engine) of your browser and see if the page comes up.

If it does open and you see a page load that looks like your company, your ISP is fine and something is wrong that your IT department will need to get involved with to fix but my hunch is that on Step 4 you will be responding to us stating that the result was 4a and you got: "could not find host whatever.yourvpnisnamed.com"

Look forward to hearing back

EDIT:

I apologize that I missed that you could ping the IP of the remote VPN but only when connected to the neighbors WiFi - If you are talking IP then name resolution is not the issue so I gotta think that there is a policy that your home IP has somehow got added to a blacklist but either way if you're having issues with just one IP at your ISP then I'd try to get a new MAC address (besides your router) which should get you a new IP and then try it... If no go then about have to be looking at your ISP being on some sort of blacklist

[Maubet]

Hello,

Thanks again for taking the time; I have tried what you suggested and I'm sending you some screenshots so you can see the results.

I could Ping the VPN's IP when connecting to my neighbors WIFI but it was not possible when connected to my WIFI. I could also access the VPN webpage when connected to the neighbors WIFI.

I forgot to mention before that the modem and router were changed twice.

Do you have any other suggestion?

Thanks in advance

Maubet

[softpaw2543]

I have seen similar behavior in the US with a different VPN service (Meraki). What we figured out was that the ISP (Comcast, in this case) was mistakenly flagging this traffic as malicious, so it was getting dropped.

A good way to check is to run a "traceroute" in each networking environment and compare.

Windows:

https://support.microsoft.com/en-us/topic/how-to-use-tracert-to-troubleshoot-tcp-ip-problems-in-wind...

Mac:

https://www.godaddy.com/help/performing-a-traceroute-in-mac-os-x-3366

The traceroute will tell you all of the servers your connection hops through on the way to reaching your company's VPN server. Naturally, the paths for both your and your neighbor's connection will be different, but what you'll want to confirm is if the traceroute is reaching the VPN or not, and at what point it gives up, if it does not reach the server.

I would start here, then engage your ISP for further help, since this may be much more complicated than just the router in your home.

Hope this helps.

[Maubet]

Hello,

Thanks very much for this helpful information; I've tried the "Tracert" and no surprise, when trying with my Telenet (ISP) connection there is "request time out".

I will be taking the results to Telenet's technicians and ask for a solution. I've done it before and never got one, I will try one last time.

It would be probably better to change to another ISP.

Thanks very once again

Maubet