FortiEMS and AutoConnect/AlwaysUP

[melkool]

Hi Team,

So I have a case with TAC that is hitting the wall in the last 2 weeks.  I have a client with 800 users , Fortigate and FortiEMS.

The main reason that he purchased FortiEMS is to have the users always connected and to be able to control which user can disconnect or not).

The problem is that even everything looks just fine, has the proper configuration from all the possible documentations,  the auto-connect is not working! Not to speak about "user

EMS:

<options>
<allow_personal_vpns>0</allow_personal_vpns>
<certs_require_keyspec>0</certs_require_keyspec>
<on_os_start_connect_has_priority>0</on_os_start_connect_has_priority>
<keep_running_max_tries>0</keep_running_max_tries>
<autoconnect_only_when_offnet>0</autoconnect_only_when_offnet>
<disable_connect_disconnect>1</disable_connect_disconnect>
<secure_remote_access>1</secure_remote_access>
<show_vpn_before_logon>0</show_vpn_before_logon>
<show_negotiation_wnd>1</show_negotiation_wnd>
<on_os_start_connect/>
<autoconnect_on_install>1</autoconnect_on_install>
<suppress_vpn_notification>0</suppress_vpn_notification>
<use_windows_credentials>1</use_windows_credentials>
<minimize_window_on_connect>0</minimize_window_on_connect>
<use_legacy_vpn_before_logon>0</use_legacy_vpn_before_logon>
<after_logon_saml_auth>0</after_logon_saml_auth>
<current_connection_name>vpn.gw</current_connection_name>
<current_connection_type>ipsec</current_connection_type>
<autoconnect_tunnel>vpn.gw</autoconnect_tunnel>

Fortigate:

config vpn ipsec phase1-interface
    edit "VPN"

        set xauthtype auto
        set save-password enable
        set client-auto-negotiate enable
        set dpd-retryinterval 60

    next

Nothing works!

Client is pushed with SCCM,  after installation it connects to EMS , policy is fetched, Remote Access tab appears but user has to enter username and password :)  After that, if the network card is disconnected and EMS goes down, upon restoration  EMS connects back, fetches the policy but again  Remote Access  requires password to connect.

To be honest I'm out of any ideas. Any help will be really appreciated.

[MZBZ]

Confirm your "On-fabric Detection Rules" is working correctly. Find the endpoint and check the Status, Location, and Matched Rules.

Open a TAC ticket if the behavior does not match the configuration. You should provide access to test endpoints during the troubleshooting and update FortiClient to the latest stable GA release (compatible with EMS and your environment).

[melkool]

Hmm I don't want to be "that guy" but I have 3 opened tickets with TAC.

Just for one of them I got a message saying "I am sorry, I'm out on vacation".  That's it :( 

Over the years TAC is useless! I tried escalating by phone but I was told something like "well this is a new setup, it doesn't matter is in production. If it's something that never worked, you cannot escalate".  So just a middle finger and regretting switching to Fortinet.

But back to our case.

I can confirm, with print screen, that indeed the On-Fabric Detection rule is there! It matches the public IP, it's saying that client is Online/On-Net but still it connects the god **bleep** tunnel :)

I'm slowly dying here...