FortiClient VPN not connecting: common causes and fixes

When FortiClient VPN will not connect, the cause is usually simple: the problem lies in the user's internet connection, settings or account rather than the firewall. Below are the checks, from the most likely to the most involved. Any user can work through the first part; the last part is for the administrator.

What the user can check

1. Is the internet working? Open any ordinary website in a browser. If it does not load, the problem is not the VPN.
2. Is the network blocking VPN? Hotel, airport and guest Wi-Fi networks often block VPN ports. Try tethering through your phone's mobile data. If it works there, the network you are on is to blame.
3. Are the connection settings right? In FortiClient, check the VPN profile's server address (Remote Gateway) and port. A single typo or wrong port is often the whole problem.
4. Is the password still valid? If the VPN uses a domain or Microsoft 365 account, the password may have expired. Try logging in elsewhere with the same password.
5. MFA code. A FortiToken Mobile code changes every 30 seconds. If codes are rejected, make sure the phone's clock is set automatically. On a new phone the token usually has to be activated again.
6. Certificate warning. If FortiClient shows a certificate warning, do not just click "continue". It may mean the firewall's certificate has expired, or that someone on the network is trying to intercept the connection. Tell your administrator.
7. FortiClient version. A very old FortiClient may not work with a newer FortiOS. Update FortiClient to the version your IT administrator recommends.

Connected, but nothing opens

If the VPN shows "Connected" but file servers or applications do not open, the cause is often overlapping networks. If the office network is, say, 192.168.1.0/24 and the home router uses the same range, the computer does not know which network to send packets to. A temporary fix is to change the home router's network; the lasting fix is to use a less common subnet in the office. The same applies to the VPN IP address pool: it must not overlap the office network or typical home networks.

Also check DNS: if a server can be reached by IP address but not by name, the VPN settings need to hand out the internal DNS servers.

Checks for the administrator

• User and group. Is the user in the group allowed to use the VPN, and is that group included in a firewall policy that allows traffic from the VPN interface to the internal network?
• Logs. Log & Report → System Events → VPN Events shows failed logins and the reason.
• SSL VPN debugging: diagnose debug application sslvpn -1 followed by diagnose debug enable. After testing, turn it off with diagnose debug disable.
• IPsec VPN debugging: diagnose vpn ike gateway list shows active IKE gateways; diagnose debug application ike -1 with diagnose debug enable shows negotiation errors.
• Certificate. Check under System → Certificates that the certificate used for the VPN has not expired.

SSL VPN is going away: moving to IPsec IKEv2

In the FortiOS 7.6 branch Fortinet is removing SSL VPN and recommends moving remote access to IPsec VPN (IKEv2) with FortiClient. SSL VPN was first removed from entry-level models with less memory (2 GB RAM), and later more broadly. If SSL VPN suddenly stops working after a firmware upgrade, or its menu has disappeared, this may be why. Read the release notes for your model and version before upgrading.

Migrating means configuring an IPsec IKEv2 tunnel on the firewall and distributing a new VPN profile to users. Note that IPsec needs UDP ports 500 and 4500, which some public Wi-Fi may block. Plan the move before an upgrade forces it on you.

When to call a professional

If the fault affects all users, appeared after a firmware upgrade, or you need to migrate from SSL VPN to IPsec, it makes sense to involve someone who knows FortiGate well. ITABIKS can help with VPN problems and migration planning; see network device setup or call +372 53 888 229.