SSL VPN client download being redirected

[Michael_Runyon]

I have noticed that recently installed Fortigate 30E and 60E devices with SSL VPN configured are redirecting FortiClient downloads to https://forticlient.com/#downloads when selecting either the MacOSx or Windows installer from the Fortigate SSL VPN web portal. This is a change from earlier behavior that downloaded the client directly from the firewall. The behavior is the same regardless of browser used or OS. I've also seen it behave in this manner in FortiOS 6.0.5 and 6.0.6, although it does not seem to occur in 6.2.0 versions.

I've confirmed the option to allow FortiClient download is enabled. No custom download location is specified of course, since I want the download to come from the firewall. The config is pretty basic, as seen below.

config vpn ssl settings     set servercert "WC2020_pfx12"     set idle-timeout 7200     set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"     set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"     set dns-server1 192.168.1.15     set dns-server2 8.8.8.8     set port 443     set source-interface "wan1"     set source-address "all"     set source-address6 "all"     set default-portal "tunnel-access" end

config vpn ssl web portal     edit "tunnel-access"         set tunnel-mode enable         set ipv6-tunnel-mode enable         set save-password enable         set ip-pools "SSLVPN_TUNNEL_ADDR1"         set ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"         config split-dns             edit 1                 set domains "<removed>"                 set dns-server1 192.168.1.15             next         end     next end

config firewall policy     edit 4         set name "SSL VPN Access"         set uuid 48ef2084-fdad-51e9-b877-f079e3157c23         set srcintf "ssl.root"         set dstintf "internal"         set srcaddr "SSLVPN_TUNNEL_ADDR1"         set dstaddr "Office LAN"         set action accept         set schedule "always"         set service "ALL"         set groups "tacacs_group" "SSL VPN Users"     next end

Have others experienced similar behavior? I have an open ticket going with support, but they have indicated they cannot reproduce the behavior in their lab environments. Any help the community might offer on this would be most appreciated. Thanks for taking the time to look.

[Michael_Runyon]

Can anyone help with this? The issue persists. I have some further details now.

The problem is only present in firmware versions in the 6.0 subset, although it occurs within any of these version. Version 6.2 does not have this issue. 

The "free" 6.2 Forticlient downloaded from the website does not allow for the usage of some advanced features. For example, "always up" (SSL VPN Keep Alives) cannot be used on the unsupported free client. 

I have a ticket open with Fortinet support, but they have been unable to offer an explanation, or even reproduce the issue, which is very strange since I can demonstrate it on multiple operating systems and browsers, across multiple firewalls. 

Please let me know if anyone has any insight as to what might be causing this issue.