We have a VPN IPsec setted by wizard to use by forticlient.
It seems that split-tunnel is disabled. If I connect and then go to internet I navigate by company ISP (tested by whatismyip).
The VPN works like a charm but we cannot make call by MS Teams. The chat works but non video/audio call. I found that there are some problem with Teams. I would know if I can exclude the Teams connection from the tunnel using ipv4-split-include/ipv4-split-exclude settings or if there is any workaround.
Using a VPN Native windows without split tunnel Teams works, calls included. The problem is Forticlient.
Using Forticlient on MAC it works, only windows does not work.
Group calls works. P2P calls no. There's a bug in the recent version of FC. Use version 6.0.0.0067 to solve the issue. It works.
I had to open a case with Microsoft support for this issue and the official response is that Teams does not work with VPN unless you enable the split tunnel option, and even with split tunel we have some users that have problems with the VPN active. This is the official article but the microsoft support technitian told me that without split tunnel Teams is not going to work.
VPNs provide a valuable service to many organizations. Unfortunately, they're typically not designed or configured to support real-time media. Some VPNs might also not support UDP. VPNs also introduce an extra layer of encryption on top of media traffic that's already encrypted. In addition, connectivity to the Teams service might not be efficient due to hair-pinning traffic through a VPN device. Furthermore, they aren't necessarily designed from a capacity perspective to accommodate the anticipated loads that Teams will require.
The recommendation is to provide an alternate path that bypasses the VPN for Teams traffic. This is commonly known as split-tunnel VPN. Split tunneling means that traffic for Office 365 won't traverse the VPN but will go directly to Office 365. This change will have a positive impact on quality, but also provides the secondary benefit of reducing load from the VPN devices and the organization's network.
To implement a split-tunnel, consult with your VPN vendor for the configuration details.
Workaround sharing desktop first works because in that case you are creating a meeting though microsoft public servers as those server are acting as gateway traffic doesn't go directly between vpn users and forticlient is bypassed.
No solution from support. I found in FTC 6.2.3 Release Notes: "581852 Skype call does not work through FortiClient (Windows) dialup IPsec VPN". The "newest" version which works for me is 6.0.2.0128. No information from support why FTC 6.0.9 and FTC EMS 6.2.6 b0910 blocks Skype and Teams.
Forget about FortiClient for Windows IPSec VPN. Buggy since 6.0.3.
I can second that there is no solution from support. The response from them was:
This is a newly reported issue, and affects FortiClient versions 6.0.3 to 6.2.6.The issue seems to only affect users on IPSec VPN tunnels, SSL VPN connections have no issue.There is currently no workaround at present.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.