IPv6 causing SSL VPN connection issue

[rpoon]

We used to have FortiClient version 6.2.6 and it works well on SSL VPN connection to our corporate network (gateway FortiOS version 6.4.3).  Once we upgraded to FortiClient 6.4.3, we start getting intermittent connectivity issue in that user cannot access network resources due to DNS resolution failure.  It's found to be caused by client's network interface attempts to query DNS through IPv6 and failed.  It then stop there without attempting querying IPv4 DNS.  We are stuck with no solution from Fortigate and desperately need to resolve it.  Does anyone encounter similar issue and can share some ideas?

Thanks

[isamt]

I have encountered the same issue.

Resolutions was to disable IPV6 on the network adaptor at the client end.

[rpoon]

Unfortunately, Fortinet team seems uninterested in providing a viable solution to the issue.  We have over 1000 clients and need a centrally managed deployment of the solution.  Also concern if disabling IPv6 on the client may cause any other issue that we are not aware of.

[isamt]

Your best option is to upgrade to FortiClient 7.0.0 or 7.0.1 which support dual stack IPv4 and IPv6

I'm currently upgrading users to 7.0.0 which is significantly better than the previous versions of the client.

[Mazdazoom]

Absolutely ridicilous that Fortinet can not figure this stuff out. we the end users paying tons of money need to do our own troubleshooting. absolutely just BS... get your team trained in issues like this. I have been pulling my hair out for 2 months with random end clients having issues connecting to internal rss because of this exact issue, why why why!

[rpoon]

Does it work with IPv6 remaining enabled?  The upgrade notes mentioned that I have to upgrade EMS Server to 7.0 to match with that.  May also need to upgrade Fortigate and other connecting components too.  A lot of preparations required.

[isamt · Accepted solution]

So far we have not encountered any issues with IPv6 enabled home users, however it was only a small percentage of our users that have IPv6 enabled Internet connections so can't say for 100% certainty yet.

FortiClient is independent of the Fortigate firmware version so yes you need EMS 7.0 or later and you may need to convert your EMS licences to version 6.4 at least then other than that you can upgrade your clients to 7.0 so not a lot of work at all.

[Pi]

We had exactly the same problem with FortiClient 7.0.7, but only if the laptop accesses the Internet via a mobile network: The mobile providers (in Germany) only use IPv6 to transport the data, which is why DNS queries are answered back with an IPv6 address. Thus, the FortiClient sends its SSL VPN requests to an IPv6 address. However, when the IPv6 packets leave the mobile network, the providers uses a 6to4-gateway - so the connection is converted to IPv4 . This seems to cause problems with the SSL VPN: FortiClient thinks it is establishing a connection to an IPv6 destination, but it is in fact IPv4. I can't explain why the problem occurs - I also assumed that it shouldn't matter, because normal surfing works over the same path without any problems.

The solution of the issue can be solved much easier than described here or otherwise (IPv6 does not need to be disabled in Windows and no Windows registry changes need to be made):
What you need to know: Before a host starts a DNS lookup, it always looks locally into the hosts file:

1. First local hosts lookup
2. Then DNS lookup

(You can reverse this behavior - but it's "out of scope" here).
Therefore, if you write into your local hosts file the IPv4 address and FQDN of your SSL VPN, the host always resolves IPv4 for that FQDN! We had no more IPv6 problems after configuring the local hosts.

The hosts file can be found
- under Windows: C:\Windows\System32\drivers\etc\hosts
- under Linux/MacOs: /etc/hosts

Cheers, Pi

[Gunna]

Managing via host files is a terrible idea, its a short term solution and doesn't scale with users or corporate infrastructure.

If the user's home network assigns both IPv6 and iPv4 address windows will preference the IPv6.

This causes a headache for DNS resolution to the corporate environment so instead a simpler solution that scales is to push the registry config via Intune\GPO to tell the client to ensure IPv4 is the preferred protocol.

[iPat]

We also faced the same issue. 

You can fix this with the change of the APN of the Provider.

For example Telekom Germany:

APN v6: internet.v6.telekom to APN v4: internet.telekom

Maybe if you use a router for the internet connection, you also have to switch from IPv6 to IPv4 in the APN settings.

Greetings