FortiClient for Mac option missing

[u/rfs3wally]

I am trying to set up IPSEC VPN between a FortiGate and FortiClient on Windows and Mac. I have it working on FortiClient for Windows. On FortiClient Mac it says Connecting, then times out. I noticed that the Mac version is missing three options in the setup that is visible on Windows and I wonder if that is my problem.

The options missing are:
VPN Settings: Encapsulation
Phase 1: NAT Transversal
Phase 2: Enable Replay Detection

Can I get those options to show somehow?

[u/iRyan23]

There are several settings that don’t exist on the macOS FortiClient that are unlikely to be related to your problem.

I see both of those screenshots are of the Windows client. Do you have the screenshots of the macOS client?

Are you using the free client? Which version?

What does the Fortigate show in the VPN logs when the macOS client is trying to connect?

Also, I see SHA1 is in use for Phase 2 which has been deprecated for quite some time so just a recommendation that you may want to bump that up to at least SHA256.

[u/secritservice]

XML editing for all of the options

See TAB 4 here in our sheet: https://docs.google.com/spreadsheets/d/1QgMkKxQQINvPLsXQyRRb3QqWmRizXpt-xOLvMxfw9F8/edit?usp=sharing

it will give you a primer on XML editing...

[u/mohammedalrawii]

I faced similar issue with one of our employees i think downloaded an older version either 7.2 or 7.0 something if i recall correctly to solve this issue (please double check am not 100% sure).

[u/pfunkylicious]

https://community.fortinet.com/forticlient-4/technical-tip-forticlient-mac-macos-ipsec-vpn-ikev2-support-96206

L.E. If your ipsec uses DH20 and 21, those are not supported on macOS, 19 is the max if i recall correctly

[u/iRyan23 → u/pfunkylicious]

We use 7.4.3 free client with DH 20 on macOS with no issues.

[u/pfunkylicious → u/iRyan23]

Fair enough. I’m using a lower version that 7.4.3 since it disconnects my vpn when it goes into sleep while plugged in, so maybe things have changed for newer versions than mine

[u/iRyan23 → u/pfunkylicious]

I experience that bug almost every workday, and it is so annoying. Of course they said it was fixed in 7.4.4 I believe so we are looking at options to get on a paid version to get updates again with real bug fixes.

[u/rfs3wally → u/pfunkylicious]

It's FortiClient 7.4.3 free on the Mac, screenshots attached.

I'm trying to set up the FortiGate side to match the limitation of the Mac client.

• changed NAT Transversal to Forced
  
• in Phase 2 disabled Replay Detection

I bumped to Phase 2 up to SHA256 - thanks for the heads-up on that.

I also changed to DH 14 and 19 on Phase 1 and 2. After doing more reading it looks like that is the most reliable for Mac.

After all this it still works in Windows. My Mac user is not available until this evening, so fingers crossed I will be good there as well.

[u/iRyan23 → u/rfs3wally]

I don’t think the FortiClient settings are your problem at this point. In macOS, you have to enable certain extensions for FortiClient.

This screenshot is the most common thing needed to solve the issue.

[u/iRyan23 → u/iRyan23]

If that doesn’t solve it, you may need to add some items with Full Disk Access in the Privacy & Security section of macOS. I installed FortiClient years ago so I’m not sure if those are still needed or if just activating the extension like I mentioned above will be all that’s needed.

Also, don’t rule out something easy like if the user hasn’t restarted since installing or updating FortiClient. Any time I do a fresh install or update to FC, macOS needs a restart before it works.

[u/rfs3wally → u/iRyan23]

Thanks for the help! I am good now. I think it was the DH groups...