Fortinet Client VPN v7.2.3.0522 cannot access remote file server

[michael_chan]

Hi Community,
I have an user on Mac Book Air OS 14.3 with Forticlient VPN v7.2.3.0522. The issue is, the VPN will connect with IP-Sec however cannot ping or access a remote file server.
Interestingly the same user with an old Windows 10 Pro laptop with the same credentials can connect on VPN, and can access the remote file server that is mapped as a network drive.
Both the VPN clients on Mac and Windows laptop have identical configurations.
Does anyone have similar issue on the Mac that cannot access a remote file server?

[dbu]

Hi @michael_chan ,
Are you folders mounted with FQDN name?

More information on mapping a network drive in Mac:
https://docs.fortinet.com/document/forticlient/7.2.3/administration-guide/993236/macos

Some times the IPv6 can cause issues. Try to disable it from Wi-fi or LAN interface of the Mac device. 

[michael_chan]

Hi dbu,
The Mac is operating on IP v4. The IPv6 is not in use.
Interestingly when the Mac connects to our firewall, it can ping one of the servers on 192.168.101.7, however cannot ping another server on 192.168.31.27.

I tried to mount the folder by IP address (192.168.31.27) and also by FQDN, it just timed prompt the server does not exist.

I tried to mount folder on 192.168.101.7, the server responded for credentials.

Just not sure why the 192.168.31.27 cannot connect.

[dbu]

Is there routing in place to reach server 192.168.31.27 ? 

[michael_chan]

When we are in office, using the LAN network, 192.168.31.27 is accessible.
The user on Windows laptop and VPN can access 192.168.31.27 remotely.
We setup the Mac in the same way, same configuration, just cannot access 192.168.31.27 while remotely.

[michael_chan]

Hi dbu,
Are you able to give further troubleshooting tips on how to resolve the issue?

[hjezzapaula]

Hi michael, 
Have you tested the same user credentials both on windows and mac?
Check also the mac routing table (netstat -nr) if there was an entry for 192.168.31.27 subnet.

[michael_chan]

Hi,
We use the same credentials on both Windows and Mac.
The Windows laptop has no issue on accessing: 192.168.31.27 server
I done a "netstat -nr" on the Mac, please view:

Internet:
Destination Gateway Flags Netif Expire
default 192.168.31.1 UGScg en0
default 192.168.31.1 UGScIg en0
10 192.168.101.183 UGSc utun4
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#12 UCS en0 !
169.254.5.1/32 192.168.101.183 UGSc utun4
172.17 192.168.101.183 UGSc utun4
192.168.0/16 192.168.101.183 UGSc utun4
192.168.31 link#12 UCS en0 !
192.168.31.1/32 link#12 UCS en0 !
192.168.31.1 64:64:4a:3e:62:ed UHLWIir en0 1200
192.168.31.32/32 link#12 UCS en0 !
192.168.31.57 a2:d2:41:d3:2c:46 UHLWIi en0 1168
192.168.31.255 ff:ff:ff:ff:ff:ff UHLWbI en0 !
192.168.101.183 192.168.101.183 UHr utun4
192.168.101.183/32 link#19 UCS utun4
223.197.33.91/32 192.168.31.1 UGSc en0
224.0.0/4 link#19 UmCS utun4
224.0.0/4 link#12 UmCSI en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI en0
255.255.255.255/32 link#19 UCS utun4
255.255.255.255/32 link#12 UCSI en0 !

Please advise on this.
Michael.

[hbac]

Hi @michael_chan,

I would suggest running debug flow and replicate the issue to see if the traffic is being dropped or not. Please refer to https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-First-steps-to-troubleshoot-connecti...

Example: (replace x.x.x.x with remote file server IP and try to ping it from the VPN client)

di deb disable
di deb res
diagnose debug flow filter clear
di deb flow filter proto 1
di deb flow filter addr x.x.x.x
diagnose debug flow show function-name enable
di deb flow show iprope en
diagnose debug console timestamp enable
diagnose debug flow trace start 500
diagnose debug enable

Run 'di deb dis' to disable the debug. 

Regards, 

[michael_chan]

The firewall settings on the Mac are disabled, however still cannot access the remote server on 192.168.31.27 which I need access to.
However, can ping and access another on 192.168.101.7.