compatibility with older Forticlient ?

[dieter]

We are in a (painful and lengthy) transition from FortiOS 5.6 to 6.

Next step in the upgrade path is from 5.6.11 tot 6.0.10. Yes, I know, we are 3 years behind... But for us this upgrade to a major version, feels like a giant milestone.

We currently use Forticlient 6.0.3.0155 for VPN (Windows only).

In the release notes for 6.0.10 on page 12 it says:

FortiOS 6.0.10 greatly increases the interoperability between other Fortinet products. This includes: FortiAnalyzer 6.0.8 FortiClient EMS 6.0.8 FortiClient 6.0.9 FortiAP 5.4.4 and later FortiSwitch 3.6.9 and later Upgrade the firmware of each product in the correct order. This maintains network connectivity without the need to use manual steps.

On page 16 it says:

If you are using FortiClient only for IPsec VPN or SSL VPN, FortiClient version 5.6.0 and later are supported.

We only use Forticlient for VPN, not endpoint checking.

Will it work ? Or do we have to upgrade Forticlient first ?

[FirewallNoob · Accepted solution]

I havent had any problems running older Forticlients other than when the OS itself complains - Windows 10 doesn't seem to play nice with clients older than 6.0.8 but the fortigates themselves don't care. I was also running Forticlient 6.0.8 with FortiOS 5.0.6 (yes, five-point-zero).

I am running FortiOS 6.4.4 with 6.0.8 and 6.0.9 Forticlients without issue. Anything newer than 6.0.9 loses the (free) ability to "Save password", "Auto Connect" and select "Always up".

[dieter]

Thank you firewallNoob.

Curious you mention Win10 not playing. We've been having no issues with Forticlient 6.0.3 . May I ask what kind of problems you experienced ?

Altough we use neither, it's good to know functionality is lost with anything newer than 6.0.9.

[FirewallNoob]

General instability - tunnels dropping, blue-screens related to Fortishield.sys, Certificate Errors (even though we don't use them) and the complete loss of ability to use DNS name as the remote gateway. On all clients (luckily only about 20) we had to change over to using IP address only. A Windows update just completely broke that function.

Being that we want to stick with 6.0.9 else lose the "Always up" feature, we've been dealing with the issues but those are mostly past us now - the real trouble began about this time last year with the October update for Win10. Now all of us are on Version 21H1 (OS Build 19043.1237) and we've adjusted and are stable. I'm sure at some point though we're going to have to pony-up for Forticlient licenses (which I'm sure is Fortinet's plan) in order to keep upgrading Windows and maintain VPN features we want.

[dieter]

Wow this sound terrible. We've had none of those issues. I would have known with 250+ VPN users...

Maybe Forticlient 6.0.8 is a really bad version in combination with Win10.

[FirewallNoob]

It sounds pretty bad but once we crossed the threshold to 6.0.9 the only thing remaining is the DNS issue. I can break that at any point on any client simply by entering vpn.companyname.com as the remote gateway. It gets to 10% and drops. Change to IP and it's 100% stable. Literally broke after a win update on patch Tuesday (May the 4th be with you) and it was a fire-drill. Good times!