FortiClient SSLVPN Windows 11 routes problem

[fortistk]

Hi All,

since some weeks we are getting connection problems using FortiClient SSLVPN on Windows 11 computers. Once the issue appears on a client there is no workaround applicable, simply stops working forever, not all the W11 PCs are affected (for now).

The client stops injecting the routes to the system, only the firewall public IP related route is added.

We believe the issue comes from the Windows endpoint and not from the Fortigate configuration.

Unfortunately there is no way for us to determine if the issue is related a windows update package.

We tried several release and combinations of the FortiClient SSLVPN (FortiSSLVPNclient.exe) and of the FortiClient VPN on several Fortigates without success. No manual or tool based removal or client reinstall solved the issue.

FortiClient VPN continues to work correctly.

The client debug log:

09/09/2022 12:16:58	info	sslvpn	date=2022-09-09 time=12:16:57 logver=1 id=96600 type=securityevent subtype=sslvpn eventtype=status level=info uid=ACEA487EC2714E9E905C532EE8FFFF devid=FCT8000000000000 hostname=PCAAA03 pcdomain=domain.com deviceip=10.7.7.176 devicemac=c8-34-8e-15-ae-00 site=N/A fctver=7.0.7.0345 fgtserial=FCT8000000000000 emsserial=N/A os="Microsoft Windows 11 Enterprise Edition, 64-bit (build 22000)" user=usr@domain msg="SSLVPN tunnel status" vpnstate=connected
09/09/2022 12:16:58	info	system	date=2022-09-09 time=12:16:57 logver=1 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=ACEA487EC2714E9E905C532EE8FFFF devid=FCT8000000000000 hostname=PCAAA03 pcdomain=domain.com deviceip=10.7.7.176 devicemac=c8-34-8e-15-ae-00 site=N/A fctver=7.0.7.0345 fgtserial=FCT8000000000000 emsserial=N/A os="Microsoft Windows 11 Enterprise Edition, 64-bit (build 22000)" user=usr@domain msg="Traffic log" sessionid=305070737 srcname=sslvpn srcport=0 direction=outbound dstip=vpn.edilgroup.ch dstport=443 proto=6 rcvdbyte=25769803804 sentbyte=30064773111 utmaction=passthrough utmevent=vpn threat=connect userinitiated=0 browsetime=0
09/09/2022 12:17:16	info	system	date=2022-09-09 time=12:17:15 logver=1 id=96823 type=systemevent subtype=system eventtype=status level=info uid=ACEA487EC2714E9E905C532EE8FFFF devid=FCT8000000000000 hostname=PCAAA03 pcdomain=domain.com deviceip=10.7.7.176 devicemac=c8-34-8e-15-ae-00 site=N/A fctver=7.0.7.0345 fgtserial=FCT8000000000000 emsserial=N/A os="Microsoft Windows 11 Enterprise Edition, 64-bit (build 22000)" user=usr@domain msg="Checking for updates"
09/09/2022 12:17:16	info	system	date=2022-09-09 time=12:17:15 logver=1 id=96813 type=systemevent subtype=system eventtype=status level=info uid=ACEA487EC2714E9E905C532EE8FFFF devid=FCT8000000000000 hostname=PCAAA03 pcdomain=domain.com deviceip=10.7.7.176 devicemac=c8-34-8e-15-ae-00 site=N/A fctver=7.0.7.0345 fgtserial=FCT8000000000000 emsserial=N/A os="Microsoft Windows 11 Enterprise Edition, 64-bit (build 22000)" user=usr@domain msg="Software updates are disabled"
09/09/2022 12:17:16	debug	update	Update task is called with dwSession=-1
09/09/2022 12:17:16	debug	update	fctupdate.fortinet.net
09/09/2022 12:17:16	debug	update	start_update_thread() called
09/09/2022 12:17:16	debug	update	Impersonated=0
09/09/2022 12:17:16	debug	update	update started...
09/09/2022 12:17:16	debug	update	update done
09/09/2022 12:17:16	debug	update	update thread exit
09/09/2022 12:17:16	debug	update	Network connection problem.

Someone out there with the same issue?

Regards.

Stefano

[fortiadm]

Hi,

after an upgrade, we are facing the same error using FortiClient v 7.0.8  and FortinetSSLVPN v.7.0.8.
The connection is established but not traffic is routed through the tunnel. The network adapter also does not get an IPv4 IP.
Is there an update on that?

That would help us a lot since we are connecting to many customers via FortiClient over CLI (using our PAM system).

[avishai0528]

facing the same issues on all pc's in the office.

my pc is

windows 11 pro 22h2 build 22621.1413

forticlient 7.2.0.0690

forticlient tools 7.2.0.0690 (FortiSSLVPNclient.exe)

it's been like that for a few months now.. really hope it will be solved because we use it with RDM like 100 times a day and now its worthless.