FortiClient VPN Problems With OSX 10.11 El Capitan

[danjahner]

I installed the GM candidate of Mac OS X 10.11 El Capitan and my FortiClient VPN has stopped working. It completes the login, but after connection, no data is transferred - the incoming and outgoing freeze. It is a split tunnel connection and neither network or internet traffic works. 

I tried disabling the firewall and System Integrity Protection, but neither had any effect. 

[lzs · Accepted solution]

I've been trying since the first public beta, and now on the final GM Candidate. The VPN problem is there. Basically, what is wrong is that OS X's resolver is sending traffic out through the primary (original) network interface, even though the route table correctly shows that the VPN tunnel (ppp0) should be used.

When you use a command like nslookup, the DNS traffic goes through the VPN tunnel (ppp0) properly.

DNS name resolution  fails because my VPN client is told to use my corporate DNS server, but my corporate DNS server refuses to serve name queries from outside the corporate network. When the FortiClient VPN is connected, OS X's name resolution traffic arrives at the DNS server with the client's public Internet IP address, and hence is refused by my DNS server.

Technically, this looks like an OS X bug. Or, perhaps there really is something wrong that FortiClient is dong. Either way, I hope FortiNet can rectify or take it up with Apple to fix El Capitan.

[Sridhar · Accepted solution]

Facing the same issue. Latest FortiClient(5.3*) did not fix it.

But, FortiClient 4.0.2082 did not have any such issues(though it occasionally stops tunneling on its own).

Waiting for a fix like everyone, but 4.0.2082 is letting me work for time being.

[hansbogert · Accepted solution]

I've gotten it to "work" by getting the DNS to use ppp0 and some route magic. Explanation is on: http://serverfault.com/questions/728702/how-to-get-forticlient-working-in-osx-el-capitan/728707#7287...

Let's hope either party fixes this, because running scripts after establishing VPN is quite cumbersome.

[Chris_Lin_FTNT · Accepted solution]

There is a new private build here:

https://dl.dropboxusercontent.com/u/58793690/mac/FortiClient_5.4.0.493_macosx.dmg

Would you guys give it a try?

[kevinboos · Accepted solution]

Chris.Lin wrote:

There is a new private build here:

https://dl.dropboxusercontent.com/u/58793690/mac/FortiClient_5.4.0.493_macosx.dmg

Would you guys give it a try?

It works for now! Thanks!

[tommy765 · Accepted solution]

Just ran El Capitan updates and it still does not work - bummer

[shenight · Accepted solution]

Chris.Lin wrote:

Here is another interim build b499.

https://dl.dropboxusercontent.com/u/58793690/mac/FortiClient_5.4.0.499_macosx.dmg

5.4.1 release may be available at the end of February.

P.S. b493 from previous post is different from the official 5.4.0 b493. Developer made the change after 5.4.0 was released.

Thanks ! I had same problems that other people since 3 months with forticlient and this new build fixes the issue!!! Great job!

[Chris_Lin_FTNT · Accepted solution]

Try this. A more recent build.

https://www.dropbox.com/s...bpx1VjzYAmiK00S9a?dl=0

[logimano]

For me, I have downgraded back to Yosemite via Time Machine (Cmd+R at boot) because I need FortiClient in my daily work. In Yosemite, everything with FortiClient works fine.

[Chris_Lin_FTNT]

The resolver issue in Mac OS X 10.11 can be verified without VPN:

For example if you have two network cards (LAN and WIFI), you manually add a route to the DNS server through the non primary interface, "ping www.google.com" will generate DNS traffic through the non primary interface (correct), however the source IP of the packet will still be the primary interface (incorrect), thus no reply will come back.

[richard451]

Are you saying it can't/won't be fixed until Apple provides a fix?

Couldn't this also be fixed by changing Fortinet to have the VPN show up as an adapter in the Network configuration (then a user can just change the dns easily)?

[Sridhar]

I get the below crash quite often. I was of an assumption that it was due to El Capitan, but upon looking into the dump trace, I see its because of Fortinet. Anyone else having this issue?

Anonymous UUID: E140DDC2-C2B4-3072-FB84-FD286608ECDB

Sat Oct 10 07:41:13 2015

*** Panic Report ***
panic(cpu 2 caller 0xffffff8016dd6a9a): Kernel trap at 0xffffff801704ccac, type 13=general protection, registers:
CR0: 0x000000008001003b, CR2: 0x0000209b81023000, CR3: 0x000000001a463000, CR4: 0x00000000001627e0
RAX: 0xdeadbeefdeadbeef, RBX: 0xffffff8037052630, RCX: 0xffffffffe856dc50, RDX: 0x0000000000000001
RSP: 0xffffff82009b3900, RBP: 0xffffff82009b3980, RSI: 0x0000000000000002, RDI: 0xffffff8036d49f80
R8: 0xffffff8036d47000, R9: 0xffffff804fbb47e0, R10: 0x0000000000000238, R11: 0xffffff81f8da9fbc
R12: 0xffffff804fbb41c0, R13: 0x0000000000000001, R14: 0xffffff804fbb47e0, R15: 0xffffff80370521a8
RFL: 0x0000000000010282, RIP: 0xffffff801704ccac, CS: 0x0000000000000008, SS: 0x0000000000000010
Fault CR2: 0x0000209b81023000, Error code: 0x0000000000000000, Fault CPU: 0x2, PL: 0

Backtrace (CPU 2), Frame : Return Address
0xffffff81f7055df0 : 0xffffff8016ce5357 
0xffffff81f7055e70 : 0xffffff8016dd6a9a 
0xffffff81f7056050 : 0xffffff8016df4093 
0xffffff81f7056070 : 0xffffff801704ccac 
0xffffff82009b3980 : 0xffffff80170499f8 
0xffffff82009b3d90 : 0xffffff80170363d7 
0xffffff82009b3de0 : 0xffffff8017037913 
0xffffff82009b3f40 : 0xffffff8016f6d58c 
0xffffff82009b3fb0 : 0xffffff8016dd14b7

BSD process name corresponding to current thread: kernel_task
Boot args: kext-dev-mode=1

Mac OS version:
15A284

Kernel version:
Darwin Kernel Version 15.0.0: Wed Aug 26 16:57:32 PDT 2015; root:xnu-3247.1.106~1/RELEASE_X86_64
Kernel UUID: 37BC582F-8BF4-3F65-AFBB-ECF792060C68
Kernel slide: 0x0000000016a00000
Kernel text base: 0xffffff8016c00000
__HIB text base: 0xffffff8016b00000
System model name: MacBookPro11,3 (Mac-2BD1B31983FE1663)

System uptime in nanoseconds: 3124454776600
last loaded kext at 25524518244: com.fortinet.fct.kext.fctapnke 1 (addr 0xffffff7f99c6b000, size 401408)
last unloaded kext at 1354301372607: com.apple.driver.AppleXsanScheme 3 (addr 0xffffff7f9920c000, size 40960)
loaded kexts:
com.fortinet.fct.kext.fctapnke 1
com.kaspersky.kext.klif 3.0.2a239
com.apple.driver.AppleMikeyHIDDriver 124
com.apple.driver.AppleHWSensor 1.9.5d0
com.apple.driver.AudioAUUC 1.70
com.apple.filesystems.autofs 3.0
com.apple.driver.AGPM 110.20.19
com.apple.driver.ApplePlatformEnabler 2.5.1d0
com.apple.driver.X86PlatformShim 1.0.0
com.apple.driver.AppleOSXWatchdog 1
com.apple.driver.AppleGraphicsDevicePolicy 3.7.7
com.apple.driver.AppleHDA 272.50
com.apple.driver.pmtelemetry 1
com.apple.iokit.IOUserEthernet 1.0.1
com.apple.driver.AppleUpstreamUserClient 3.6.1
com.apple.iokit.IOBluetoothSerialManager 4.4.0f4
com.apple.Dont_Steal_Mac_OS_X 7.0.0
com.apple.GeForce 10.0.6
com.apple.driver.AppleIntelHD5000Graphics 10.0.8
com.apple.driver.AppleHV 1
com.apple.driver.AppleMCCSControl 1.2.13
com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport 4.4.0f4
com.apple.driver.AppleIntelSlowAdaptiveClocking 4.0.0
com.apple.driver.AppleSMCLMU 208
com.apple.driver.AppleIntelFramebufferAzul 10.0.8
com.apple.driver.AppleLPC 3.1
com.apple.driver.AppleCameraInterface 5.41.0
com.apple.driver.AppleMuxControl 3.11.31
com.apple.driver.AppleThunderboltIP 3.0.8
com.apple.driver.AppleUSBCardReader 3.7.1
com.apple.driver.AppleUSBTCButtons 245.4
com.apple.driver.AppleUSBTCKeyboard 245.4
com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1
com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0
com.apple.BootCache 37
com.apple.iokit.IOAHCIBlockStorage 2.8.0
com.apple.driver.AppleAHCIPort 3.1.5
com.apple.driver.AirPort.Brcm4360 1000.13.1a3
com.apple.driver.AppleSmartBatteryManager 161.0.0
com.apple.driver.AppleACPIButtons 4.0
com.apple.driver.AppleRTC 2.0
com.apple.driver.AppleHPET 1.8
com.apple.driver.AppleSMBIOS 2.1
com.apple.driver.AppleACPIEC 4.0
com.apple.driver.AppleAPIC 1.7
com.apple.nke.applicationfirewall 163
com.apple.security.quarantine 3
com.apple.security.TMSafetyNet 8
com.apple.kext.triggers 1.0
com.apple.driver.DspFuncLib 272.50
com.apple.kext.OSvKernDSPLib 525
com.apple.iokit.IOSerialFamily 11
com.apple.nvidia.driver.NVDAGK100Hal 10.0.6
com.apple.nvidia.driver.NVDAResman 10.0.6
com.apple.driver.CoreCaptureResponder 1
com.apple.iokit.IOSurface 108.0.1
com.apple.driver.AppleSMBusController 1.0.14d1
com.apple.iokit.IOBluetoothHostControllerUSBTransport 4.4.0f4
com.apple.iokit.IOBluetoothFamily 4.4.0f4
com.apple.driver.AppleHDAController 272.50
com.apple.iokit.IOHDAFamily 272.50
com.apple.iokit.IOAudioFamily 203.8
com.apple.vecLib.kext 1.2.0
com.apple.iokit.IOSlowAdaptiveClockingFamily 1.0.0
com.apple.AppleGraphicsDeviceControl 3.11.31
com.apple.iokit.IOAcceleratorFamily2 203.7.1
com.apple.driver.AppleBacklightExpert 1.1.0
com.apple.iokit.IONDRVSupport 2.4.1
com.apple.driver.AppleGraphicsControl 3.11.31
com.apple.iokit.IOGraphicsFamily 2.4.1
com.apple.driver.X86PlatformPlugin 1.0.0
com.apple.driver.AppleSMC 3.1.9
com.apple.driver.IOPlatformPluginFamily 6.0.0d7
com.apple.iokit.IOSCSIBlockCommandsDevice 3.7.7
com.apple.iokit.IOUSBMassStorageDriver 1.0.0
com.apple.iokit.IOSCSIArchitectureModelFamily 3.7.7
com.apple.driver.AppleUSBMultitouch 250.4
com.apple.iokit.IOUSBHIDDriver 900.4.1
com.apple.driver.usb.AppleUSBHostCompositeDevice 1.0.1
com.apple.driver.usb.AppleUSBHub 1.0.1
com.apple.driver.CoreStorage 517
com.apple.iokit.IOAHCIFamily 2.8.0
com.apple.driver.AppleThunderboltDPInAdapter 4.1.2
com.apple.driver.AppleThunderboltDPAdapterFamily 4.1.2
com.apple.driver.AppleThunderboltPCIDownAdapter 2.0.2
com.apple.driver.AppleThunderboltNHI 4.0.1
com.apple.iokit.IOThunderboltFamily 5.0.6
com.apple.iokit.IO80211Family 1100.23
com.apple.driver.mDNSOffloadUserClient 1.0.1b8
com.apple.iokit.IONetworkingFamily 3.2
com.apple.driver.corecapture 1.0.4
com.apple.driver.usb.AppleUSBXHCIPCI 1.0.1
com.apple.driver.usb.AppleUSBXHCI 1.0.1
com.apple.iokit.IOUSBFamily 900.4.1
com.apple.iokit.IOUSBHostFamily 1.0.1
com.apple.driver.AppleUSBHostMergeProperties 1.0.1
com.apple.driver.AppleEFINVRAM 2.0
com.apple.driver.AppleEFIRuntime 2.0
com.apple.iokit.IOHIDFamily 2.0.0
com.apple.iokit.IOSMBusFamily 1.1
com.apple.security.sandbox 300.0
com.apple.kext.AppleMatch 1.0.0d1
com.apple.driver.AppleKeyStore 2
com.apple.driver.AppleMobileFileIntegrity 1.0.5
com.apple.driver.AppleCredentialManager 1.0
com.apple.driver.DiskImages 414
com.apple.iokit.IOStorageFamily 2.1
com.apple.iokit.IOReportFamily 31
com.apple.driver.AppleFDEKeyStore 28.30
com.apple.driver.AppleACPIPlatform 4.0
com.apple.iokit.IOPCIFamily 2.9
com.apple.iokit.IOACPIFamily 1.4
com.apple.kec.Libm 1
com.apple.kec.pthread 1
com.apple.kec.corecrypto 1.0
Model: MacBookPro11,3, BootROM MBP112.0138.B15, 4 processors, Intel Core i7, 2.3 GHz, 16 GB, SMC 2.19f12
Graphics: Intel Iris Pro, Intel Iris Pro, Built-In
Graphics: NVIDIA GeForce GT 750M, NVIDIA GeForce GT 750M, PCIe, 2048 MB
Memory Module: BANK 0/DIMM0, 8 GB, DDR3, 1600 MHz, 0x02FE, -
Memory Module: BANK 1/DIMM0, 8 GB, DDR3, 1600 MHz, 0x02FE, -
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x134), Broadcom BCM43xx 1.0 (7.21.94.25.1a3)
Bluetooth: Version 4.4.0f4 16320, 3 services, 19 devices, 1 incoming serial ports
Network Service: Wi-Fi, AirPort, en0
Serial ATA Device: APPLE SSD SM0512F, 500.28 GB
USB Device: USB 3.0 Bus
USB Device: Apple Internal Keyboard / Trackpad
USB Device: BRCM20702 Hub
USB Device: Bluetooth USB Host Controller
Thunderbolt Bus: MacBook Pro, Apple Inc., 17.1

[brudy]

Tonight FortiClient 5.4 was released, which supports El Capitan. Give it a try.

Anyway the DNS problem still exists, as you can see in the release notes, because it is an Apple problem. 

[jweber]

Thanks for the update. The release notes here mention a workaround for the DNS problem:

"use a public DNS, so that all DNS traffic goes through the public interface"

Can you explain how you would do that? Any response from Apple yet?

[Sridhar]

brudy wrote:

Tonight FortiClient 5.4 was released, which supports El Capitan. Give it a try.

Anyway the DNS problem still exists, as you can see in the release notes, because it is an Apple problem. 

Would you mind linking it here? I am not able to find 5.4 anywhere.

Thanks in advance.

[danielcantwell]

I am having the same issue, everything worked perfect yesterday. Updated to El Capiton and now when I connect the VPN I loose connection to everything except the network I am connected to through the VPN. Is there any update when this issue will be resolved. 

[kenneth_Compres]

Any solutions to this?

[richard451]

I'm having the same issue.  Quite annoying.   Hopefully a solution will be available shortly.