FortiClient Licensing / Concurrent sessions

[Jan_1966]

Hi,

I hope someone can help me as I am still struggling with Fortinet Licensing structure.

We have a fortigate 301e running 6.0.4.We tested with the free 10 FortiClient that the Firewall comes with and all seemed fine.

Now we purchased a 50 License pack FortiClient EMS and installed an EMS server where the clients register to.

We have currently 37 of our 50 FortiClients deployed most on version 6.2.6 and some still on 6.0.9. They are all registerd to the EMS server.

However when it comes to Remote Access we still seem to have the limit of 10 concurrent IPsec dial up tunnels. What do I need to do to be able to allow more than 10 concurrent IPsec Dial up tunnels?

After the 10 sessions any new session doesn't seem to connect or even sometimes kicks out another session.

With the current COVID 19 issues we really need to increase our number of concurrent Remote Access VPN sessions.

Many thanks.  

[Markus]

Hi Jan For the VPN Part, you don't need FC Licenses on the FG. As far as I know, the License is only necessary if you like to do Telemetry. https://forum.fortinet.com/tm.aspx?m=110974

https://www.forticlient.com/

Good luck

Best

[ShawnZA]

Did someone not set a limit perhaps? If you go to Global Resources, then look under VPN, perhaps a limit set on the last one "Dial-up Tunnels"?

[TecnetRuss]

When you created your IPSec Remote Access VPN did you give it a name that was 13 characters long?

In the VPN Creation Wizard (Remote Access), as you type in the name you'll see the following warnings based on the length of the name you give it:

[ul]

9 characters or less = no warning

10 characters = "10000 concurrent user(s) will be supported"

11 characters = "1000 concurrent user(s) will be supported"

12 characters = "100 concurrent user(s) will be supported"

13 characters = "10 concurrent user(s) will be supported"

14+ characters = "Please enter at most 13 characters"[/ul]

This has to do with the way each IPSec VPN session is named (see Markus's link).

Russ

NSE7

[Markus]

Thanks Russ, for the clarification

[sonarden]

I have a similar issue.  FG 300D with 5.6.12 and I cannot connect more than 10 IPSEC VPN users concurrently.  I have 25 licensed machines in Forticlient EMS 6.2

Theoretically there should be 10,000 allowed tunnels for the VPN with a ten-char name from a device limitation standpoint.

When 10 users are connected, no more can connect.

The FG is not seeing the licenses in FortiClient EMS.

My assumption is I have to upgrade the FG to 6.0.9 in order for the FortiClient EMS to be recognized in the security fabric.

I have a support case in right now, but I think they are overwhelmed at the moment.  I am looking for a diag command to confirm the VPN user concurrency issue, and will update this if I find one.