Forticlient Registration Key Mistmatch - Randomly

[jason_wisniewski]

I've had this issue for awhile and so far hasn't been able to get much help from Technical Support because it's completely random and I can't pull machines from end users for testing.

Forticlient 5.2 and 5.2.3

Fortigate 800c Cluster - 5.2.3

Randomly people will receive a pop-up message, almost always on first login in the morning, with a title of "Fortigate Detected" and a message that states "Registering to Fortigate" with a space for registration key, and an error directly above that states "Registration Key Mismatch".  However these users had a fully registered client beforehand.

Today I had the same experience after being out of the office for 2 weeks with extended VPN connectivity.  I hit cancel as a test and Forticlient showed as not being registered.  So I clicked "Register to Fortigate" and it happily connected to my cluster without the need for a key.  I immediately pulled the logs off the client and it showed this:

8/31/2015 5:54:05 AM Notice FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 8/31/2015 5:54:05 AM Notice VPN id=96602 msg="SSLVPN service started successfully." vpntype=ssl 8/31/2015 5:54:07 AM Notice ESNAC id=96953 msg="Endpoint Control Status changed - Unknown" 8/31/2015 5:54:55 AM Notice ESNAC id=96953 msg="Endpoint Control Status changed - Corporate ID Mismatch" 8/31/2015 6:38:52 AM Notice ESNAC id=96953 msg="Endpoint Control Status changed - Disabled"

Thoughts?  Fortinet support keeps wanting me to give them a client that is experiencing the issue but that isn't easy to do given the amount of down time required of the person whose laptop is having issues.

[Crosbywa]

I have had the same problem when it attempts to reach out to Fortigate to register the endpoint I get a 169 Ip address. 

9/1/2015 8:47:31 AMNoticeESNACid=96953 msg="Endpoint Control Status changed - Pre-Registered"

9/1/2015 8:47:58 AMNoticeESNACid=96953 msg="Endpoint Control Status changed - Disabled"