token pop-up closes as soon as it appears

[awss]

I work on a Mac (Apple M1 Max, macOS Sonoma 14.6.1) and use FortiClient.app for VPN  (version 7.4.0.1645) access to my work network.

When I enter my credentials, a window (see screenshot) pops up very quickly. Previously, it used to wait for me to enter the requested token or approve it on my mobile device. However, now I cannot connect to the VPN service.

I followed the instructions in this video, but they seem quite outdated. I tested it on my older Mac, and everything appears to be working fine.

I've tried reinstallation several times.

Here's my fortitray.log:

20240924 01:03:34 TZ=+0100 [FortiTray:DEBG] VPNMessageBridge.m:491 Request VPN statistics
20240924 01:03:42 TZ=+0100 [FortiTray:INFO] VPNMessageBridge.m:434 Request VPN connect
20240924 01:03:42 TZ=+0100 [FortiTray:DEBG] VPNMessageBridge.m:465 VPN profile: MEH
20240924 01:03:42 TZ=+0100 [FortiTray:DEBG] VpnManager.swift:228 Ignore Secure compliance Check as FCT is not connected to EMS
20240924 01:03:42 TZ=+0100 [FortiTray:INFO] VpnManager.swift:1733 Connect VPN: MEH
20240924 01:03:42 TZ=+0100 [FortiTray:DEBG] VpnManager.swift:988 On VPN status change: NotConnected -> Connecting
20240924 01:03:42 TZ=+0100 [FortiTray:INFO] VpnManager.swift:1034 VPN connecting
20240924 01:03:42 TZ=+0100 [FortiTray:INFO] VpnManager.swift:1419 Start VPN: MEH
20240924 01:03:42 TZ=+0100 [FortiTray:DEBG] VpnManager.swift:228 Ignore Secure compliance Check as FCT is not connected to EMS
20240924 01:03:42 TZ=+0100 [FortiTray:DEBG] sslvpn_bridge.mm:266 EMS tenant id: 
20240924 01:03:42 TZ=+0100 [FortiTray:INFO] FctBridge.m:154 Public IP retrieved: 
20240924 01:03:42 TZ=+0100 [FortiTray:DEBG] vpnconnection.mm:919 Server URL: https://sslvpn.moorfields.nhs.uk:443
20240924 01:03:42 TZ=+0100 [FortiTray:DEBG] vpnconnection.mm:432 Request: [GET] "/remote/info"
20240924 01:03:42 TZ=+0100 [FortiTray:DEBG] vpnconnection.mm:358 FSV_HOSTNAME added: demonia
20240924 01:03:42 TZ=+0100 [FortiTray:DEBG] vpnconnection.mm:406 Resolved IP address 192.168.145.71 for domain name: sslvpn.moorfields.nhs.uk
20240924 01:03:43 TZ=+0100 [FortiTray:INFO] sslvpn.cpp:218 ApiEncMethod: 0
20240924 01:03:43 TZ=+0100 [FortiTray:INFO] sslvpn.cpp:220 ApiRemoteAuthTimeout: 120
20240924 01:03:43 TZ=+0100 [FortiTray:INFO] sslvpn.cpp:222 ApiServerSalt: 7a4f2e6f
20240924 01:03:43 TZ=+0100 [FortiTray:INFO] sslvpn.cpp:223 flag: 7391
20240924 01:03:43 TZ=+0100 [FortiTray:DEBG] vpnconnection.mm:573 Request: [GET] "/remote/login"
20240924 01:03:43 TZ=+0100 [FortiTray:DEBG] vpnconnection.mm:358 FSV_HOSTNAME added: demonia
20240924 01:03:43 TZ=+0100 [FortiTray:DEBG] HttpsNWConnection.swift:130 Connected to 192.168.145.71
20240924 01:03:43 TZ=+0100 [FortiTray:INFO] sslvpn.cpp:337 Send authentication request
20240924 01:03:43 TZ=+0100 [FortiTray:DEBG] vpnconnection.mm:573 Request: [POST] "/remote/logincheck"
20240924 01:03:43 TZ=+0100 [FortiTray:DEBG] vpnconnection.mm:358 FSV_HOSTNAME added: demonia
20240924 01:03:43 TZ=+0100 [FortiTray:DEBG] HttpsNWConnection.swift:130 Connected to 192.168.145.71
20240924 01:03:43 TZ=+0100 [FortiTray:INFO] sslvpn.cpp:401 Check response
20240924 01:03:43 TZ=+0100 [FortiTray:DEBG] sslvpn.cpp:425 Server requires FortiToken. Token info: ftm_push
20240924 01:03:43 TZ=+0100 [FortiTray:DEBG] sslvpn.cpp:483 Auto FTM Push
20240924 01:03:43 TZ=+0100 [FortiTray:DEBG] vpnconnection.mm:573 Request: [POST] "/remote/logincheck"
20240924 01:03:43 TZ=+0100 [FortiTray:DEBG] vpnconnection.mm:358 FSV_HOSTNAME added: demonia
20240924 01:03:43 TZ=+0100 [FortiTray:INFO] VpnManager.swift:3016 Input request type: 1
20240924 01:03:43 TZ=+0100 [FortiTray:DEBG] HttpsNWConnection.swift:130 Connected to 192.168.145.71
20240924 01:03:44 TZ=+0100 [FortiTray:INFO] VpnManager.swift:3100 Notification: Cancel input
20240924 01:03:44 TZ=+0100 [FortiTray:DEBG] vpnconnection.mm:741 Stop process.
20240924 01:03:44 TZ=+0100 [FortiTray:DEBG] vpnconnection.mm:791 Cancel http. http task is running: No
20240924 01:03:44 TZ=+0100 [FortiTray:INFO] VpnManager.swift:3100 Notification: Cancel input
20240924 01:03:44 TZ=+0100 [FortiTray:INFO] sslvpn_bridge.mm:130 Login canceled
20240924 01:03:44 TZ=+0100 [FortiTray:INFO] VpnManager.swift:2942 Notification: Login canceled
20240924 01:03:44 TZ=+0100 [FortiTray:DEBG] VpnManager.swift:988 On VPN status change: Connecting -> NotConnected
20240924 01:03:44 TZ=+0100 [FortiTray:INFO] VpnManager.swift:1027 VPN disconnected
20240924 01:03:44 TZ=+0100 [FortiTray:DEBG] VpnManager.swift:826 On VPN session end
20240924 01:03:44 TZ=+0100 [FortiTray:DEBG] VpnManager.swift:865 Waiting for VPN session to end
20240924 01:03:44 TZ=+0100 [FortiTray:DEBG] sslvpn_bridge.mm:607 VPN session wait until finished
20240924 01:03:44 TZ=+0100 [FortiTray:DEBG] VpnManager.swift:867 VPN session ended
20240924 01:03:44 TZ=+0100 [FortiTray:DEBG] VpnManager.swift:876 On VPN disconnected

main.log:

[2024-09-24 01:03:01.346] [info]  Platform detected: darwin
[2024-09-24 01:03:01.364] [info]  web-contents-created contents.id=1
[2024-09-24 01:03:01.365] [info]  Index - createWindow pathname=/Applications/FortiClient.app/Contents/Resources/app.asar/base.html
[2024-09-24 01:03:01.367] [info]  initAvatarInstance
[2024-09-24 01:03:01.367] [info]  initSAMLInstance
[2024-09-24 01:03:01.367] [info]  Saml - init
[2024-09-24 01:03:01.367] [info]  Saml - listenSamlLoginRequest
[2024-09-24 01:03:01.369] [info]  Pipe server started _pipeName=/tmp/f272e54842dc8e993516d168744b5dc4_502
[2024-09-24 01:03:01.369] [info]  ZTNA server started _pipeName=/tmp/1ed3b4a64e1741b5a5b539d2ebb1b9b8_502
[2024-09-24 01:03:01.369] [info]  PipeServer is listening SESSION=502
[2024-09-24 01:03:01.369] [info]  Ztna server - listening
[2024-09-24 01:03:01.572] [info]  compliance configDir=/Users/alan/Library/Application Support/Fortinet/FortiClient/config
[2024-09-24 01:03:01.586] [info]  Index - did-finish-load
[2024-09-24 01:03:01.593] [info]  ready-to-show
[2024-09-24 01:03:01.594] [info]  Index - process.argv=["/Applications/FortiClient.app/Contents/MacOS/FortiClient"]
[2024-09-24 01:03:01.730] [info]  Quarantined - props={"message":"","reason":"","has_quarantine_code":false,"quarantined":false}
[2024-09-24 01:03:01.730] [info]  Quarantined - props={"quarantined":false}
[2024-09-24 01:03:01.733] [info]  renderer ready -  IPC_RENDERER_REQUEST.FETCH_INVITATION_CODE Tue Sep 24 2024 01:03:01 GMT+0100 (Western European Summer Time)
[2024-09-24 01:03:01.777] [info]  BEFORE -- IPC_RENDERER_REQUEST.VPN_TUNNEL_INFO, this.currentVpn)
[2024-09-24 01:03:01.778] [info]  IPC_RENDERER_REQUEST.VPN_TUNNEL_INFO
[2024-09-24 01:03:01.778] [info]  AFTER -- IPC_RENDERER_REQUEST.VPN_TUNNEL_INFO, this.currentVpn)
[2024-09-24 01:03:01.794] [info]  App - getVpnState - VPN_TOPICS.GET_CONNECTION_STATE_RESP - state={"ipsec_state":0,"saml_vpn_name":"","ssl_state":0,"connection_name":""}
[2024-09-24 01:03:01.797] [info]  IPC_RENDERER_REQUEST.LOADED argv=undefined
[2024-09-24 01:03:01.797] [info]  window-manager:handleWindowLoaded
[2024-09-24 01:03:01.797] [info]  window-manager:handlePossibleProtocolLauncherArgs
[2024-09-24 01:03:01.797] [info]  window-manager:handleCreateMainWindow
[2024-09-24 01:03:01.807] [info]  Vpn - viewVpnName getConnectionState ="{\"ipsec_state\":0,\"saml_vpn_name\":\"\",\"ssl_state\":0,\"connection_name\":\"\"}"
[2024-09-24 01:03:01.809] [info]  viewVpnName - defaultTunnel=null
[2024-09-24 01:03:01.809] [info]  Vpn - setCurrentVpn name=MEH
[2024-09-24 01:03:01.809] [info]  Vpn - setCurrentVpn this.connection_name=MEH this.connection_type=ssl
[2024-09-24 01:03:01.851] [info]  VPN - viewDisconnected
[2024-09-24 01:03:01.912] [info]  resetVPNConnectionState
[2024-09-24 01:03:08.103] [info]  Vpn - viewVpnName getConnectionState ="{\"ipsec_state\":0,\"saml_vpn_name\":\"\",\"ssl_state\":0,\"connection_name\":\"\"}"
[2024-09-24 01:03:08.110] [info]  viewVpnName - defaultTunnel=null
[2024-09-24 01:03:08.110] [info]  Vpn - setCurrentVpn name=MEH
[2024-09-24 01:03:08.110] [info]  Vpn - setCurrentVpn this.connection_name=MEH this.connection_type=ssl
[2024-09-24 01:03:08.139] [info]  Vpn - viewVpnName getConnectionState ="{\"ipsec_state\":0,\"saml_vpn_name\":\"\",\"ssl_state\":0,\"connection_name\":\"\"}"
[2024-09-24 01:03:08.139] [info]  VPN - viewDisconnected
[2024-09-24 01:03:08.200] [info]  resetVPNConnectionState
[2024-09-24 01:03:08.202] [info]  viewVpnName - defaultTunnel=null
[2024-09-24 01:03:08.202] [info]  Vpn - setCurrentVpn name=MEH
[2024-09-24 01:03:08.202] [info]  Vpn - setCurrentVpn this.connection_name=MEH this.connection_type=ssl
[2024-09-24 01:03:08.234] [info]  VPN - viewDisconnected
[2024-09-24 01:03:08.292] [info]  resetVPNConnectionState
[2024-09-24 01:03:34.232] [info]  Vpn - viewVpnName getConnectionState ="{\"ipsec_state\":0,\"saml_vpn_name\":\"\",\"ssl_state\":0,\"connection_name\":\"\"}"
[2024-09-24 01:03:34.236] [info]  viewVpnName - defaultTunnel=null
[2024-09-24 01:03:34.237] [info]  Vpn - setCurrentVpn name=MEH
[2024-09-24 01:03:34.237] [info]  Vpn - setCurrentVpn this.connection_name=MEH this.connection_type=ssl
[2024-09-24 01:03:34.282] [info]  VPN - viewDisconnected
[2024-09-24 01:03:34.343] [info]  resetVPNConnectionState
[2024-09-24 01:03:42.918] [info]  VPN - viewConnecting
[2024-09-24 01:03:44.091] [info]  VPNMessage: [WM_USER_PIPEMSG_VPN_DISCONNECTED] {"VPNMessage":"dummy","id":"1649"}
[2024-09-24 01:03:44.095] [info]  VPN - viewDisconnected
[2024-09-24 01:03:44.171] [info]  resetVPNConnectionState

fctc.log:

20240924 01:03:01.427 TZ=+0100 [servctl:EROR] FCTClientDelegate:215 Failed to send request
20240924 01:03:01.553 TZ=+0100 [AD:INFO] ad_utils:487 No domain from domain controller
20240924 01:03:01.561 TZ=+0100 [AD:INFO] ad_utils:487 No domain from domain controller
20240924 01:03:01.582 TZ=+0100 [AD:INFO] ad_utils:487 No domain from domain controller
20240924 01:03:01.585 TZ=+0100 [AD:INFO] ad_utils:487 No domain from domain controller
20240924 01:03:01.655 TZ=+0100 [DB:EROR] db_api:76 DB select query failed, SELECT MAX(CAST(scanId AS INTEGER)) FROM VulHistory_V3, message is: (null), status is: 7
20240924 01:03:01.655 TZ=+0100 [DB:EROR] db_api:76 DB select query failed, SELECT COUNT(*), severity, severity_priority(severity) FROM VulHistory_V3 WHERE scanId = -2 AND (vulStatus IS NULL OR (vulStatus != 1 AND vulStatus != 4)) GROUP BY severity ORDER BY severity_priority(severity);, message is: (null), status is: 7
20240924 01:03:01.655 TZ=+0100 [DB:EROR] db_api:76 DB select query failed, SELECT MAX(CAST(scanId AS INTEGER)) FROM VulHistory_V3, message is: (null), status is: 7
20240924 01:03:01.655 TZ=+0100 [DB:EROR] db_api:76 DB select query failed, SELECT COUNT(*) FROM VulHistory_V3 a,VulAttr b WHERE a.vulId=b.vulId AND b.vulAttrType=1 AND vulStatus=3 AND scanId = -2;, message is: (null), status is: 7
20240924 01:03:42.985 TZ=+0100 [servctl:EROR] FCTClientDelegate:215 Failed to send request

[AEK]

Which FortiClient VPN version?

Do you get the same behavior when you try from Windows or Linux?

[awss]

I've updated the original post with more details. I use version 7.4.0.1645. I only use Mac and as I mentioned in my post, it's happening only to my current Mac. I tested in my old Mac and it worked fine. I suspected it's something related to permissions.
I've uninstalled FortiClient as much as I could, even the kernel extension which required reboot in Recovery Mode and disabling SIP.
It used to work before, but a month ago I started to have this issue and at that time I think my Mac was updated, and the service as well because my company forced to change my password and this created a lot of problems. I can still access my work VPN via web but not anymore via FortiClient.app and the Remote Desktop.app.

[AEK]

Can you double-check if the instructions in the special notice are applied?

https://docs.fortinet.com/document/forticlient/7.4.0/macos-release-notes/223986/special-notices

If it doesn't help then can you also try with an older version like 7.0.13 or 7.2.5?

[awss]

I followed that instructions. I remember quite well given the permissions. The weird thing I saw was this:

I had two instances of `fctservct|2` and one was deactivated. Enabled both, after shutting down the app twice, just in case, disabling and enabling all again.
Command `systemextensionsctl list` does show

Spoiler

1 extension(s)
--- com.apple.system_extension.network_extension
enabled active teamID bundleID (version) name [state]
* * AH4XFXJ7DK com.fortinet.forticlient.macos.vpn.nwextension (7.4.0/1645) vpnprovider [activated enabled]

Then I went to test again and unfortunately, same issue. I will try a older version as you suggest.

[awss]

Sorry, I'm having some (a lot actually) difficulty to find old versions.

[awss]

Look, I upgraded my Mac to macOS Sequoia 15.0, reinstalled everything and now it's working.