Forticlient doesnt Work with IPSec - Installations on Win11 without FortiVPNService

[RolandBaumgaertner72]

Hi all,

we have more and more problems changing from SSL VPN to IPSec.

I tried with 2 PCs Win11 where SSL VPN worked fine for months but IPSec is not doing any connections. Since I see in the Logs I cant connect via UDP500 (changes to 1011) I found out, that not all services of the Forticlient are installed correctly:

Get-Service | findstr /i forti >>> Running FA_Sheduler   Forticlient Service Scheduler

I tried with different Forticlient versions, from 7.0.X to 7.4.X and always the same. I deactivated in Windows Security everything but I cant get rid of:

CodeIntegrityPolicyEnforcementStatus: 1

Any good workaround to solve the problem? I got to the point to install Win11 again and this is something I dont want to do for x remote users.

Thanks!

[funkylicious]

hi,

on a working computer buth with Window Server i can confirm that the output of the command Get-Service only would list FA_Scheduler

I would try the following from cmd/PS:

netstat -ano | findstr 500 ( note down the PID - last on the right )

tasklist /svc /Fi "PID eq <above>" - it should list svchost.exe / IKEEXT

if another service/process/software is running, then I would stop/uninstall it.

Then i would check in services.msc the service name IPsec Policy Agent and check if it's in status Running and if not Start it, or if it's already running do a Restart of the service then check if the connection works.

Also, another thing to check is that the ISP of the user is not blocking outgoing ports UDP/500 and/or UDP/4500 , which you can check it PortQry for example.

[RolandBaumgaertner72]

Hi, 

thanks....checking services.msc I dont see any IPSec Policy Agent. I still believe in both Win11 I cant install an IPSec client. 

500/ 4500 cant be blocked since I tried also with an older Win10 and 6.4 FC and IPSec connects right away.

Any other suggestions? Cant be that I am the only one having problems configuring IPSec on Forticlient on Win11, no?

Thanks! 

[funkylicious]

see, https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-FortiClient-IPSEC-VPN-connection-i...