The Fortigate SSL-VPN Firewall Host Check feature does not work

[Jin-Gyu]

When I tested it through FortiVPN with a Windows 10 laptop, it worked fine, but when I tested it through FortiClient with a Windows 11 laptop, it didn't work.

It is the same environment except that Windows 11 laptop has EMS interworking as FortiClient.

What is the problem?

[Durga_Ashwath · Accepted solution]

Hi Jin,

Good Day,

The issue you're experiencing with the FortiClient SSL VPN host check feature not working on a Windows 11 laptop could be due to several factors. Here are some steps to troubleshoot and resolve the problem:

1. Due to TLS Version Compatibility, Windows 11 uses TLS 1.3 by default, while Windows 10 uses TLS 1.2. Ensure that the cipher suite settings on the FortiGate are configured to support TLS 1.3. If the `TLS-AES-256-GCM-SHA384` option has been removed, it may cause issues with Windows 11.

2. Verify that the EMS (Endpoint Management Server) settings are correctly configured and compatible with Windows 11. Ensure that the FortiClient version on Windows 11 is supported by the EMS.

3. Ensure that the host check settings are correctly configured on the FortiGate. The host check feature relies on the WMI namespace `\root\SecurityCenter2` to check the health status of antivirus products. Confirm that this namespace is accessible and functioning on Windows 11.

4. Ensure that you are using a compatible version of FortiClient for Windows 11. Check for any updates or patches that may address compatibility issues with Windows 11.

Please do follow the below article:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiClient-SSL-VPN-connects-successfully-...

Thanks.

Regards,
Durga A

[Jin-Gyu]

Thank you for your answer.