Wrong configuration received by FortiClient

[raffaeledp]

Hello everybody,

I'm working on a Fortigate 70G v7.2.11.

Long time ago I created an IPSec Tunnel using a wizard tool.

On this tunnel, I enabled the split tunneling.

I have 2 Windows PCs (PC A - Windows 10 / PC B - Windows 11)

On both PCs I have a free FortiClient VPN version (PC A: 7.2 / PC B: 7.2 and then I tried to upgrade to 7.4).

What I'm pretty sure of is that each client should receive, connecting with the same settings on the same tunnel, the same configuration.

This is the PC B configuration:

    

This is the IPSec tunnel:

 On the working PC A, routes are configured correctly (route print):

Network address             Mask          Gateway     Interface  Metrics

          0.0.0.0          0.0.0.0    192.168.1.254     192.168.1.66     35

         10.0.0.2  255.255.255.255   10.212.134.222   10.212.134.221      1

         10.1.0.0    255.255.255.0   10.212.134.222   10.212.134.221      1

  10.212.134.221  255.255.255.255         On-link    10.212.134.221    257

But on PC B, the same command returns:

Network address             Mask          Gateway     Interface Metrics
          0.0.0.0          0.0.0.0    192.168.178.1  192.168.178.106     35
          0.0.0.0          0.0.0.0    192.168.178.1  192.168.178.113     50
          0.0.0.0          0.0.0.0   10.212.134.222   10.212.134.221     25
   10.212.134.221  255.255.255.255         On-link    10.212.134.221    281

The result of that is that PC B cannot access internet and routes are completely wrong. But why am I receiveing two different configurations? Configurations should be sent by Fortigate...so, how is it possible that two clients receive two different configurations?

[funkylicious]

if you have a realtek nic on the w11 pc, try updating the drivers to something newer or do a clean install of FCT if they are already up2date.

[kojulho2]

Had this issue popup today. Issue was with firewall policy not allowing the SSLVPN interface in the "From" field destined "To" the internal network (due to many policy edits, it was left out on accident.)

[raffaeledp]

Thanks for your reply,

it does not seem to be the same kind of problem. Because the fact that PC B cannot access internet is due to the fact that it receives a configuration that is the same as if "split tunneling" was disabled on Fortigate. So 10.212.134.222 becomes its default gateway, but it's wrong, because in the tunnel configuration, I enabled "split tunneling".

[raffaeledp · Accepted solution]

Hello everybody, as I said previously, the client received a wrong configuration by Forticlient. It was the only client that received a disabled split-tunnell configuration, Solution was to disable and then rienable again the split-tunneling on Fortigate.

Thank you everybody