"Unable to establish the VPN connection. The VPN server may be unreachable." (-5) or (-9)

[wolfee]

Myself and 3 other remote users for a gov't contract have been unable to connect our FortiClient VPN software since April 25th. (18 days and counting)  The gov't owns the software (serial number) and they have their own all-encompassing ticket but obviously that isn't progressing very fast.  We need to work.  Any help appreciated.  Everything I read online about this error points to adjusting the MTU.  I've run the following commands on both my gov't issued laptop as well as my own PC both on the same network (Comcast):

(gov't laptop) netsh interface ipv4 show subinterface

<returned value for Local Area Connection> MTU=1400

(my own PC) returns MTU=1500

From what I've read, the goal is to get a ping that is not "Fragmented but DF set."

(gov't laptop) ping <ip address> -f -l <value> RESULTS:

1372 and below= "Request timed out"

1374 and above= "Packet needs to be fragmented but DF set."

(my own PC) RESULTS:

1472 and below= "Request timed out"

1474 and above= "Packet needs to be fragmented but DF set."

There is no value on either machine that does not get fragmented or timed out.

I gave this info to those that are working the issue on the gov't side but like I said, they don't seem to understand how serious this is to our contract.  Any help/advice greatly appreciated.

[wolfee]

In case anyone else has this problem, we use GFE laptops (gov't provided, no admin rights) and work remotely.  The problem seems to be receiving the group policy updates as well as the McAfee HBSS updates.  If you work remotely, even if you connect to the network providing the updates, it hasn't been updating automatically.  You have to run the updates yourself, so VPN into the network that provides the updates (Juniper Secure VPN).

For group policy settings/updates: "gpupdate /force"

For McAfee HBSS updates: right-click on the McAfee Icon on your task bar and select "update security".  Once that is done, right-click the McAfee Icon again and select "McAfee Agent Status Monitor...".  There will be seven buttons along the right side, you're interested in the top four.  By clicking the first button (Collect and Send Props), it should proceed through the first four buttons automatically but some people had to do it manually.  After that was done, I have been able to connect to our servers using FortiClient.  Hopefully it's resolved but I'll update if the problem returns.

[ede_pfau]

FWIW I've had the exact same error message on a FG-200B running v4.3.18. Debugging and sniffing didn't help, there was nothing to be seen.

A simple reboot of the cluster solved this instantly. Uptime before was 197 days.

[dphills]

I am having the same issue.  We have figured out that if we go into our internet options and click on the advance tab to reset the browser, we can then login via the FortiClient.  However, we have to do this quite often.  Does anyone know why the FortiClient is tied into Internet Explorer and how it can be bypassed?