FortiClient - Remote Access IPsec Connection Issue - MacOS

[Sohonet]

Hi All, 

We are experiencing an issue with the forticlient VPN client on MacOS 15.5

We are currently planning our roll out of remote access via IPsec and moving away from SSL VPNs, 

The issue we are having is that after a device cold start/reboot, the initial attempt to connect to the remote access VPN via IPsec always fails and gives an "Connection was terminated unexpectedly" error.

Trying it immediately again afterwards, it still fails.

The current workaround is to connect to the same remote VPN endpoint but via SSL VPN, and then trying the IPsec once more; however, this does not always seem to work.

Another workaround seems to be waiting 5-10 minutes, and trying the IPsec connection seems to work.

Once successfully connected via the IPsec VPN, it continues to work until the client device is rebooted/shut down.

Looking through the Forticlient debug logs, we are getting an "IPsec error -104"; however, when running an authentication debug on the FortiGate, I can see we are successfully authenticating via LDAP + Duo MFA.

When using the same login details to the same LDAP server but via SSL VPN, it works and authenticates successfully 100% of the time. 

Because of this, I do not trust that the -104 error is real.

When running Wireshark captures, I can also see the FortiClient app begins to initiate the phase 1 process, but when the FortiGate firewall responds, the Forticlient application does not continue on to the quick mode process and gets stuck sending NAT-Keepalive messages to the FortiGate.

The issues seem to have started after upgrading the macOS version to 15.5.

We are not experiencing this issue with older versions of MacOS (ie. macOS 12.7.6)

The issue is also affecting versions of Forticlient VPN, including 7.4.0, 7.4.1, 7.4.2 & the current version 7.4.3

This issue is limiting our rollout of the IPsec remote access VPN. 

if anyone has experienced a similar issue, I would greatly appreciate any assistance.

[Sohonet]

Hi Kumar,

Are you able to provide any update on the similar case that the Fortinet engineering team are investigating? 

kind regards

Ryan Bates 

Sohonet.

[Sohonet]

Hi Sacrio23,

From all my additional testing/reading syslogs and researching error messages, I'm pretty confident this is now a Forticlient/MacOS compatibility issue or some bug in the latest version of Forticlient.

Given Kumar_B's post saying my issue appears to be a similar issue to one that has been reported to Fortinet's engineers, I hope we get an updated version of FortiClient ASAP that will fix this issue.

As mentioned in my previous posts, I have opened a case with Fortinet support, but as we are not using EMS-managed Forticlient, they are unwilling to provide me with any further support. I just hope my case does get passed on to the Fortinet Engineering team so they can use it to assist in resolving the issue.

[kolelvo2]

Sure. If I click on the tunnel, there is a template type "Dialup - iOS Native". To get the P2 settings, I clicked on the the "Convert to custom tunnel" button. So it should be default settings.

[sharmar]

Hello Sohonet, 

Could you please share the following logs on the firewall side, :

diagnose vpn ike log filter clear

diagnose debug console timestamp enable

diagnose debug application fnbamd -1

diagnose vpn ike log-filter dst-addr4 x.x.x.x <---------------Clients Public IP

di de app eap_proxy

diagnose debug app ike -1

diagnose debug application samld -1

diagnose debug enable

Thanks,