Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
rpoon
New Contributor II

IPv6 causing SSL VPN connection issue

We used to have FortiClient version 6.2.6 and it works well on SSL VPN connection to our corporate network (gateway FortiOS version 6.4.3).  Once we upgraded to FortiClient 6.4.3, we start getting intermittent connectivity issue in that user cannot access network resources due to DNS resolution failure.  It's found to be caused by client's network interface attempts to query DNS through IPv6 and failed.  It then stop there without attempting querying IPv4 DNS.  We are stuck with no solution from Fortigate and desperately need to resolve it.  Does anyone encounter similar issue and can share some ideas?

 

Thanks

1 Solution
isamt

So far we have not encountered any issues with IPv6 enabled home users, however it was only a small percentage of our users that have IPv6 enabled Internet connections so can't say for 100% certainty yet.

 

FortiClient is independent of the Fortigate firmware version so yes you need EMS 7.0 or later and you may need to convert your EMS licences to version 6.4 at least then other than that you can upgrade your clients to 7.0 so not a lot of work at all.

View solution in original post

9 REPLIES 9
isamt
Contributor

I have encountered the same issue.

Resolutions was to disable IPV6 on the network adaptor at the client end.

 

 

rpoon
New Contributor II

Unfortunately, Fortinet team seems uninterested in providing a viable solution to the issue.  We have over 1000 clients and need a centrally managed deployment of the solution.  Also concern if disabling IPv6 on the client may cause any other issue that we are not aware of.

isamt

Your best option is to upgrade to FortiClient 7.0.0 or 7.0.1 which support dual stack IPv4 and IPv6

 

I'm currently upgrading users to 7.0.0 which is significantly better than the previous versions of the client.

 

Mazdazoom

Absolutely ridicilous that Fortinet can not figure this stuff out. we the end users paying tons of money need to do our own troubleshooting. absolutely just BS... get your team trained in issues like this. I have been pulling my hair out for 2 months with random end clients having issues connecting to internal rss because of this exact issue, why why why!

rpoon
New Contributor II

Does it work with IPv6 remaining enabled?  The upgrade notes mentioned that I have to upgrade EMS Server to 7.0 to match with that.  May also need to upgrade Fortigate and other connecting components too.  A lot of preparations required.

isamt

So far we have not encountered any issues with IPv6 enabled home users, however it was only a small percentage of our users that have IPv6 enabled Internet connections so can't say for 100% certainty yet.

 

FortiClient is independent of the Fortigate firmware version so yes you need EMS 7.0 or later and you may need to convert your EMS licences to version 6.4 at least then other than that you can upgrade your clients to 7.0 so not a lot of work at all.

Pi
New Contributor

We had exactly the same problem with FortiClient 7.0.7, but only if the laptop accesses the Internet via a mobile network: The mobile providers (in Germany) only use IPv6 to transport the data, which is why DNS queries are answered back with an IPv6 address. Thus, the FortiClient sends its SSL VPN requests to an IPv6 address. However, when the IPv6 packets leave the mobile network, the providers uses a 6to4-gateway - so the connection is converted to IPv4 . This seems to cause problems with the SSL VPN: FortiClient thinks it is establishing a connection to an IPv6 destination, but it is in fact IPv4. I can't explain why the problem occurs - I also assumed that it shouldn't matter, because normal surfing works over the same path without any problems.

 

The solution of the issue can be solved much easier than described here or otherwise (IPv6 does not need to be disabled in Windows and no Windows registry changes need to be made):
What you need to know: Before a host starts a DNS lookup, it always looks locally into the hosts file:

  1. First local hosts lookup
  2. Then DNS lookup

(You can reverse this behavior - but it's "out of scope" here).
Therefore, if you write into your local hosts file the IPv4 address and FQDN of your SSL VPN, the host always resolves IPv4 for that FQDN! We had no more IPv6 problems after configuring the local hosts.

 

The hosts file can be found
- under Windows: C:\Windows\System32\drivers\etc\hosts
- under Linux/MacOs: /etc/hosts

 

Cheers, Pi

Gunna
New Contributor

Managing via host files is a terrible idea, its a short term solution and doesn't scale with users or corporate infrastructure.

 

If the user's home network assigns both IPv6 and iPv4 address windows will preference the IPv6.

This causes a headache for DNS resolution to the corporate environment so instead a simpler solution that scales is to push the registry config via Intune\GPO to tell the client to ensure IPv4 is the preferred protocol.

Vincent_RLG
New Contributor

I was encountering the same type of issues. Like 90% of all issues, it came from DNS resolution who was made in IPv6 prior to IPv4. As we don't use IPv6 internally, clients with IPv6 enabled internet connections where unable to resolve internal names, because they were querying their Internet provider instead of the one pushed through the VPN connection.

Workarounds are:

- https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-Issues-with-resolving-the-internal...

or

- Disable IPv6 on the Client interface connecting to Internet or generally

or

- having a full dual stack infrastructure.

I wonder if there isn't already a solution mixing IPv6 DNS-Database , "private" IPv6 and 6to4....

 

Cheers

Labels
Top Kudoed Authors