FortiClientVPN static route

[Fumagalli]

Hi, only on my computer, the static route is not created when I connect with the FortiClientVPN .
on other PCs no problem.
Do you have any advice on why it doesn't work?
S.O. win 11

thanks in advance

Fabrizio

[Fumagalli]

UP

[Fumagalli]

Has anyone come up with ideas this month?
Thanks in advance

[srajeswaran]

Can you confirm the firewall policy for your VPN connection allows all service (Internet) or specific service only?

The below article talks about a dead peer detection feature on windows that will cause route change if the dpd check fails.

https://learn.microsoft.com/en-us/previous-versions/aa454008(v=msdn.10)?redirectedfrom=MSDN

Check if this feature is enabled/disabled as suggested in http://www.howtonetworking.com/Routers/deadgateway.htm

[Fumagalli]

thank you so much for your answer
The "EnableDeadGWDetect" entry does not exist
I create it and should I set it to 0 or 1?

[srajeswaran]

To disable dead gateway detection, set the registry value to 0.

[sw2090]

the route link shows you have two default routes. One via your ethernet interface and one (accoarding to its gateway ip) via the SSL VPN Interface (i.e. FortiClient).

The one via the VPN does have the higher metric which means all traffic will hit the ethernet interface except if that were down or if the traffic matches one of the other existing static/connected routes.

It also implies that there is no split tunneling enabled on your vpn since this is (execpt from the metric) the typical behaviour of FortilClient VPNs without split tunneling. 

[Fumagalli]

first of all, thank you so much for your reply

I don't understand the first part?
What do I have to change in the configuration?

[sw2090]

well a default route is there to match all traffic that doesn't match anything else.  

If there is more than one default route the metric sets the order. Lowest metric will be used first.

Since the second default route has the ssl vpn interface as destination I suppose it has been set up by forticlient when it established your vpn. You could recheck this by re-viewing your routing table without the vpn connected. If it was set up by FortiClient it will be gone then.

You will only have static routing over your vpn when split tunneling is on. This has to be configured on the Fortigate end of the tunnel. Split tunneling will have FortiClient set up those static routes upon connecting your vpn. 

Just usually - without split tunneling - FortiClient will set up a default route with very low metric so all traffic that doesn't match any other routes will go through the vpn. Why it didn't do that in your case - cannot say.

Somitimes (e.g. in business environments) you do want all traffic to go through the vpn as long as it is connected. Then you have to have the accoarding policies on the other end of the vpn. Otherwise you would lose internet access once the vpn connected.

If you just want to be able to access specific subnets through the vpn I recommend using split tunneling and let the internet traffic still use your default route via ethernet. 

[Fumagalli]

Tried several times but the problem persists

The problem is only on my Notebook
On other PCs with the same configuration on the Fortinet side (on the firewall) and in FortiClient VPN the problem does not exist

[Fumagalli]

I also reset the network cards

The only solution is to connect with "FortinetClient VPN", once the connection has been established, change the IP of the network card "FORTINET SSL VPN VIRTUAL...." assigning the ip that is displayed in the connection status
in this way , it create correct route