Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
svl
New Contributor

MacOS Big Sur Fortclient VPN IPSec issues

Just installed macOS Big Sur and cannot get a connection with Fortinet firewall VPN anymore, while it did work with macOS Catalina.

 

I tried Forticlient version 6.4 which seems to connect just fine (I get an IP in expected range), but ssh/ping does not work. And also I cannot access a intranet http/https page.

 

Also tried multiple versions of 6.0.x but they all fail to connect and show "Connection was terminated unexpectedly. Error -104". After that, the keyboard (Macbook 16 inch) even fails to register any pressed buttons. For example I open app "notes" and cannot type anything (with every keystroke a sound is played but nothing is written). The only way to get out of this situation is to click "connect to VPN" in forticlient again and before it gets to the error click "disconnect". Then all works as usual (except the VPN obviously).

 

Anyone else having these issues?

 

Update Nov 25th 2020: 

Ok, so after quite a bit of testing by the people who maintain our firewall, we managed to make IPSec VPN work with native Mac OS Big Sur VPN client. I am always amazed by the lack of Fortinet response in this type of issues, as the solution seems pretty simple in the end. Eventually the configuration at fortigate firewall stayed exactly as it was, the only configuration I needed to add locally (with respect to using the FortiClient software) is to add a group name under "Authentication Settings". So to make it work we:

[ul]
  • Setup IPSec VPN in Mac OS Netwerk preferences (see also https://support.apple.com/guide/mac-help/set-up-a-vpn-connection-on-mac-mchlp2963/mac) using fields server address, account name (my personal account name), password (my personal account password) and under "Authentication settings" the shared secret (the shared password) and Group Name (had to get this from the firewall maintainer and never had to fill this in for FortiClient before).[/ul]

    Hopefully this helps others to get Fortigate IPSec VPN work with both Mac OS Big Sur and MacOS Catalina (both tested with our config).

  • 6 Solutions
    LJSilva
    New Contributor II

    If you're only using Forticlient to connect to your VPN, in macOS Big Sur you no longer need it. The built-in Cisco IPsec VPN of Big Sur will now connect and correctly establish a tunnel to your Fortinet VPN and it's very stable and reliable. I never managed to to this in Catalina, but it seems Apple may have corrected or changed the Cisco IPSec code in Big Sur and it's now working like a charm. I tried it yesterday and it worked flawlessly.

    View solution in original post

    Totoshka
    New Contributor II

    Kiran wrote:

    Same issue for me as well. Able to connect to IPSec VPN, but not able to open/connect to any internal URLs/Resources. And it's working fine for users with previous version of MacOS.

    The problem is similar. It all started after the update macOs Big Sur. 

     

     

     

    View solution in original post

    Kiran
    New Contributor II

    Yeah, But unfortunately when I reached out to support, they said that currently there is no supported version for MacOS 11 yet and will be available in future versions. So thought that better to suggest some alternative to people who are suffered like me, until the fix is release.

    View solution in original post

    kcerb
    New Contributor III

    Kiran wrote:

     

    Did you configure your IPSec VPN with Phase 1 - Local ID? When I tried native CISCO IPSec VPN, it did not work for VPN which is configured without Phase 1 - Local ID. Modify your VPN configuration with Phase 1 - Local ID and give it as 'Group Name'(which will be the option below the Shared Secret) while configuring the native VPN.

    You can add Local ID in native Mac OS VPN client (type: Cisco). Just click Authentication settings and type your LocalID in the Group Name field.

    FGT60B, FGT100A, FGT100D

    View solution in original post

    FGT60B, FGT100A, FGT100D
    mharwow
    New Contributor

    kcerb wrote:

    Kiran wrote:

     

    Did you configure your IPSec VPN with Phase 1 - Local ID? When I tried native CISCO IPSec VPN, it did not work for VPN which is configured without Phase 1 - Local ID. Modify your VPN configuration with Phase 1 - Local ID and give it as 'Group Name'(which will be the option below the Shared Secret) while configuring the native VPN.

    You can add Local ID in native Mac OS VPN client (type: Cisco). Just click Authentication settings and type your LocalID in the Group Name field.

    [attachImg]https://forum.fortinet.com/download.axd?file=0;191690&where=message&f=Setup-VPN-on-Mac-Linux-and-Windows.png[/attachImg]

    This solved the problem for me. I made an account just to say thanks. Once I filled out the Group Name I was connected. Hopefully my company supports the newer version of Fortinet in the future, but I'm happy to use the built-in VPN for now. 

    View solution in original post

    Bobbyla

    Just to confirm the VPN only installer is now updated on the website - Mac now connects using IPSEC on BigSur

     

    WOOHOO

     

    Thanks for updating it. (Labelled as 6.4 but when installing pulls the latest release 6.4.2.1.1305)

     

    Rob

     

    [image][/image]

    View solution in original post

    58 REPLIES 58
    BrokenRecord

    I grabbed 6.4.2 from the support portal. https://support.fortinet.com/Download/FirmwareImages.aspx

     

    Looks like they haven't added it to the public forticlient site yet.

    Totoshka

    BrokenRecord wrote:

    I grabbed 6.4.2 from the support portal. https://support.fortinet.com/Download/FirmwareImages.aspx

     

    Looks like they haven't added it to the public forticlient site yet.

    This is a class, but unfortunately the link is empty. I understand that not everyone is available.

    Is it possible to put it on a public resource?
    jan_p
    New Contributor

    Please share with us version 6.4.2.

    chuck_m
    New Contributor

    jan p wrote:

    Please share with us version 6.4.2.

    It would be greatly appreciated!

    Totoshka
    New Contributor II

    Hi, update FORTI VPN 6.4.2 official is out. Download on the official page. https://www.forticlient.com/downloads
    Works with Big Sur 
    Bobbyla

    Just to confirm the VPN only installer is now updated on the website - Mac now connects using IPSEC on BigSur

     

    WOOHOO

     

    Thanks for updating it. (Labelled as 6.4 but when installing pulls the latest release 6.4.2.1.1305)

     

    Rob

     

    [image][/image]

    chuck_m

    Thanks for the update, Rob!

    mike_dp

    We are still experiencing issues with Big Sur and Forticlient 6.4.2. We randomly get a "Connection Error" and we have to either force close or reinstall Forticlient to make it work.

    Fortigate : 80E, 80F, 100E, 200F, 300E : 6.4.6

    FortiAnalyzer, ForticlientEMS

    Fortigate : 80E, 80F, 100E, 200F, 300E : 6.4.6 FortiAnalyzer, ForticlientEMS
    grayloon

    I've been using FortiClient for years, but I may switch to the Mac-native VPN client. Is it possible to configure a single tunnel that works with both FortiClient and Mac-native to ease the transition for my users? I tried a few things with my tunnel this weekend, but I could never get both to connect to the same config.

    Music_IT

    Hi all, I'm using a FortiGate 80F and FortiClient VPN version 77.0.0.0022 and IPsec is working.

    But I noticed the VPN using the FortiClient is very slow.

    I reached 26,2 / 20,9 MB/s while using the BigSur 11.4 Native IPsec VPN I'm getting 54,1 / 72,2 MB/s. I have also tried FortiClient VPN version 6.4.3.1325 but that is giving the same results. I have tested it internal so there is no internet traffic what can cause this. Do you see same results and does anyone has an idea what to do to get the same speed with the FortiClient IPsec VPN. I prefer to use the FortiClient because we used MFA with the FortiTokens. Rgds Rob

    Announcements

    Select Forum Responses to become Knowledge Articles!

    Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

    Labels
    Top Kudoed Authors