FortiClient proactively defends against advanced attacks. Its tight integration with the Security Fabric enables policy-based automation to contain threats and control outbreaks. FortiClient is compatible with Fabric-Ready partners to further strengthen enterprises’ security posture.
Article Id 189777
This article describes how to create a VPN only FortiClient installer.

There is no VPN only FortiClient available since FortiClient is a suite that comprises various Components.  (AntiVirus, Web Filtering, Application Firewall, Remote Access (VPN), Vulnerability Scanning)

A standalone FortiClient VPN installer can be created using the FortiClient Configurator tool.  

Version 5.4.x requires a license and can be downloaded from the support site:  Path:  Download > Firmware Images > Image Path  >  FortiClient > Windows > v5.00 > 5.4 > 5.4.5 > FortiClientTools_5.4.5.0891> FortiClientConfigurator
If the FortiGate is licensed with a "FortiClient Telemetry and Compliance License", then the FortiClient 5.4.x Configurator tool license is also included.

Version 5.6.x is a free tool but only available through the FNDN site.  Access to the site requires two sponsor emails. (Please contact the Reseller for these)
"Please be noted, that Technical Support cannot provide access to FNDN or sponsors emails.   To obtain sponsors emails please contact your Fortinet sales representative, or contact Fortinet sales department on one of the numbers or chat given at: "

FNDN Registration


Unlicensed FortiClient Support

Technical support for FortiClient is only provided with a FortiClient license.

Support for unlicensed FortiClients is only provided via our support Forum. (
Support for FortiClient Configurator 5.6 is on through the FNDN site. (

Using the FortiClient Configurator Tool

Start the FortiClient Configurator tool.

The [Configuration File] page will ask if there is an xml configuration file to use.  
To create a VPN only installation that includes pre-configured tunnel information, specify it on this page. (To get an xml configuration, first install FortiClient, setup all the VPN tunnels, specify the settings, test.  Open the FortiClient Console, Go to File > Settings > System then click on Backup. Save. Use this xml.conf file in the above page.)

NOTE: If not specifying tunnel information, clicking Next will skip.

Click Next.

mforbes_Configuration file.png

In the [Features to Install] page:

Select only the Secure Remote Access Module.
Deselect Security Fabric Agent.  (Needed only when Endpoint is part of the Security Fabric)
Click Next.


In the [Page Signing] click Skip. (Packaging process starts)

mforbes_Package signing.png

Click Finish to save the output.


A new window will open up to display the installer packages located inside a new folder called "repackaged".


The FortiClient Configurator tool will create both x32 and x64-bit installers.
Inside each folder there will be two additional folders, an ActiveDirectory and a ManualDistribution folder.

The ActiveDirectory folder will contain two files, FortiClient.msi and FortiClient.mst. These are the files needed when installing using Windows AD SCCM. The .msi is the installer, the .mst is the configuration.

mforbes_Active Directory.png

To use the .msi use the following command:  
msiexec /qn /i "FortiClient.msi" TRANSFORMS=FortiClient.mst
NOTE: The .msi installer does not contain any settings and will install ALL modules.

The ManualDistribution folder contains a single .exe installer that should only be used for manual installations and will install the Modules specified by the Configurator tool, including settings that were specified with the xml configuration file. (ie. vpn tunnel settings)

mforbes_Manual Distribution.png

To .exe installer can be installed silently using the command: 

FortiClient 5.4.5 Administration Guide

CustomizeFortiClientusingXMLsettings (5.4.5)

FortiClient 5.6.6 Configurator Tool

FortiClient 5.6.6 XML Reference

Security Fabric

FortiClient Compliance Guide: