Frequent Automatic Disconnections with IPsec VPN Servers in FortiClient 7.4

[lxh395252851]

I'm using IPsec VPN with FortiClient 7.4. I've configured two IPsec VPN servers (primary and backup) and deployed the settings to clients via FortiClient EMS. However, during usage, the connection to the primary server consistently drops every 30 to 60 minutes, while the backup server disconnects even more frequently and irregularly.

All components are running version 7.4, and there’s no packet loss between the public networks involved. This issue affects all users in our environment.

Has anyone encountered this behavior? Any suggestions on how to troubleshoot or resolve it would be greatly appreciated.

[AEK]

Which FortiClient version exactly (I mean the x in 7.4.x)?

Can you try connecting your client using other internet link or other ISP?

[lxh395252851]

This issue appears to be widespread, affecting nearly all ISPs. The versions currently in use are as follows:

Primary/standby firewall version: 7.2.11

FortiClient versions: 7.4.4 

FortiClient EMS versions：7.4.3

[Carson_Daniels]

Hi — frequent disconnections with FortiClient 7.4 IPsec VPN are often caused by IKE or dead peer detection (DPD) timers being too short, or NAT/keepalive issues. Try the following:

Increase the IKE SA and DPD timers on both VPN servers.

Enable VPN keepalive/ping to maintain the tunnel.

Check for overlapping subnets or duplicate IP assignments that might trigger rekeying.

Review client logs for specific error codes to pinpoint the drop reason.

These steps usually stabilize connections and reduce frequent automatic disconnections.

[lxh395252851]

Thank you for your suggestions.

Currently, the DPD interval on the firewall is set to 60 seconds. The configuration pushed via EMS only enables DPD but does not allow customization of the DPD mode or detection interval. In this case, I believe the negotiated parameters should follow those configured on the firewall.

The FortiClient is deployed within the internal network of the branch site, and NAT traversal has been enabled in the EMS-deployed configuration. Regarding potential NAT/keepalive issues, could you advise how I should go about troubleshooting them? Specifically, would it be necessary to reduce the IKE Phase 1 keepalive interval and the IPsec Phase 2 SA lifetime to better align with the NAT timeout policies across the customer’s various sites?

From the logs provided by the customer, we only observe the client’s IP address switching between the VPN-assigned address and its local LAN address—this appears to be expected behavior during an IPsec VPN disconnection. Unfortunately, no additional diagnostic logs are available for further analysis.

[AEK]

EMS 7.4.3 is not 100% compatible with FCT 7.4.4. You should update your EMS.

https://docs.fortinet.com/document/forticlient/7.4.0/ems-compatibility-chart

Well it may or it may not be the root cause of the issue but it is worth a try.