Forticlient in Windows 10

[SGGJim]

Hi,

We have updated to Windows 10 and now our Forticlient does not work. It say's that we are connected, but we cannot ping / reach any hosts.

log:

5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: [SSL-IN] buf size = 65540, ptr = 0, space = 65540 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: [SSL-IN] len = -1 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: poll_recv_ssl -> SSL_ERROR_WANT_READ 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: poll_recv_ssl return 0 bytes, read after timeout 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: [tunnel_loop_read_socket] wait for socket event 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: wait for socket event timeout, try to do a read 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: [SSL-IN] buf size = 65540, ptr = 0, space = 65540 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: [SSL-IN] len = -1 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: poll_recv_ssl -> SSL_ERROR_WANT_READ 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: poll_recv_ssl return 0 bytes, read after timeout 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: [tunnel_loop_read_socket] wait for socket event 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: wait for socket event timeout, try to do a read 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: [SSL-IN] buf size = 65540, ptr = 0, space = 65540 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: [SSL-IN] len = -1 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: poll_recv_ssl -> SSL_ERROR_WANT_READ 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: poll_recv_ssl return 0 bytes, read after timeout 5/27/2016 11:34:08 AM Debug VPN FortiSslvpn: 5040: [tunnel_loop_read_socket] wait for socket event

[Wayne11]

I'm pretty sure you have the well known Win10 DNS routing problem.

Try to set the metric on the LAN/WiFi adapter to be higher (15) than the one windows assigns to the VPN (11). Do the same on your IPv6 settings when it's not disabled.

If you still have the problem, then add this 2 registry keys to disable the new "feature" in Windows 10. The DNS resolver sends DNS requests in parallel to all available network interfaces and uses the fastest reply to come.

Key: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DNSClient Value:  DisableSmartNameResolution Data:  1 Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters Value: DisableParallelAandAAAA Data:  1

[SGGJim]

Hi,

Thank you for answering!

I tried it both, but unfortunately it does not work.

I did some research and it seems that when I uninstall my Cisco VPN Client that Forticlient works. But if Cisco VPN Client is installed only the Cisco Client works. We need both installed. 

Hope you have a solution for this!

[SGGJim]

So we uninstalled everything again and installed only Forticlient, but it doesn't work anymore.

It say's connected, but I cannot ping any host

This is the log:

6/1/2016 4:20:25 PM Debug VPN (repeated 31 times in last 62 sec) FortiSslvpn: CSslvpnBase::RefreshConnection() Called. 6/1/2016 4:20:26 PM Notice VPN date=2016-06-01 time=16:20:25 logver=1 type=traffic level=notice sessionid=27567360 hostname=xxxx uid=6C1D176241D44F2A83DF898BA273D6C8 devid=FCT8000501172583 fgtserial=N/A regip=N/A srcname=sslvpn srcproduct=N/A srcip=xxxx srcport=N/A direction=outbound destinationip=xxxx remotename=N/A destinationport=443 user=xxxx proto=6 rcvdbyte=90194314045 sentbyte=42949675317 utmaction=passthrough utmevent=vpn threat=connect vd=N/A fctver=5.4.0.0780 os="Microsoft Windows 10 Professional Edition, 64-bit (build 10586)" usingpolicy="" service= url=N/A userinitiated=0 browsetime=N/A 6/1/2016 4:20:26 PM Notice VPN id=96600 msg="SSLVPN tunnel status" vpnstate=connected vpntunnel="xxxx" vpntype=ssl 6/1/2016 4:20:26 PM Debug VPN FortiSslvpn: CSvlauncherDlg::InitFortiSslvpn() Called. 6/1/2016 4:20:26 PM Debug VPN FortiSslvpn: CSvlauncherDlg::InitFortiSslvpn(): Daemon is running 6/1/2016 4:20:26 PM Debug VPN FortiSslvpn: SslvpnAgent: before connect pipe 6/1/2016 4:20:26 PM Debug VPN FortiSslvpn: SslvpnAgent: before create file 6/1/2016 4:20:26 PM Debug VPN FortiSslvpn: SslvpnAgent: ActiveX connected to SslvpnDaemon 6/1/2016 4:20:26 PM Debug VPN FortiSslvpn: CSvlauncherDlg::InitFortiSslvpn(): SslvpnAgent initialized successfully 6/1/2016 4:20:28 PM Debug VPN FortiSslvpn: CSslvpnBase::RefreshConnection() Called. 6/1/2016 4:20:35 PM Debug VPN (repeated 4 times in last 8 sec) FortiSslvpn: CSslvpnBase::RefreshConnection() Called. 6/1/2016 4:20:38 PM Debug VPN FortiSslvpn: CSvlauncherDlg::DisconnectFortiSslvpn() Called. 6/1/2016 4:20:38 PM Notice VPN FortiSslvpn: 12188: Ras: connection to fortissl terminated 6/1/2016 4:20:38 PM Debug VPN FortiSslvpn: CSslvpnBase::RefreshConnection() Called. 6/1/2016 4:20:40 PM Notice VPN date=2016-06-01 time=16:20:39 logver=1 type=traffic level=notice sessionid=27567360 hostname=xxxx uid=6C1D176241D44F2A83DF898BA273D6C8 devid=FCT8000501172583 fgtserial=N/A regip=N/A srcname=sslvpn srcproduct=N/A srcip=xxxx srcport=N/A direction=outbound destinationip=xxxx remotename=N/A destinationport=443 user=xxxx proto=6 rcvdbyte=90194327562 sentbyte=42949688469 utmaction=passthrough utmevent=vpn threat=disconnect vd=N/A fctver=5.4.0.0780 os="Microsoft Windows 10 Professional Edition, 64-bit (build 10586)" usingpolicy="" service= url=N/A userinitiated=0 browsetime=N/A 6/1/2016 4:20:40 PM Debug VPN FortiSslvpn: HttpOpenRequest(): hReq=NULL, URL=/remote/logout, LastError=6 6/1/2016 4:20:40 PM Debug VPN FortiSslvpn: CSslvpnBase::RefreshConnection() Called. 6/1/2016 4:20:41 PM Debug VPN (repeated 1 times in last 2 sec) FortiSslvpn: CSslvpnBase::RefreshConnection() Called. 6/1/2016 4:20:42 PM Debug VPN FortiSslvpn: SslvpnAgent: Closed pipe instance 6/1/2016 4:20:44 PM Debug VPN FortiSslvpn: CSslvpnBase::RefreshConnection() Called.

( The xxxx are normally ip addresses / user etc.)

Hopefully you can help us!

[ddskier]

The registry keys don't work for Windows 10,  only Windows 8.

For Windows 10, you can use GPO to deactivate the feature. Follow the steps below to do this:

[ol]

Press WIN+R and write gpedit.msc

Expand Administrative templates

Expand Network

Click DNS-client

Double-click "Turn off smart multi-homed name resolution"

Check the box called "Enabled"

Click "Apply all" and then "OK"[/ol]