Helpful ReplyFortiClient VPN Problems With OSX 10.11 El Capitan

Page: < 12345.. > >> Showing page 3 of 8
Author
brudy
New Member
  • Total Posts : 11
  • Scores: 2
  • Reward points: 0
  • Joined: 2011/12/03 11:26:16
  • Location: Switzerland
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/05 12:49:00 (permalink)
0
you can create manually a default route on your Mac, which directs all traffic into your tunnel interface.
 
on the Mac you run: 
"sudo route add default -interface ppp0"
 
That forces all your traffic into the tunnel. In this case you have to be aware, that conneting to some sites on the internet will fail, if the Forti is not configured accordingly.
#41
logimano
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/10/05 01:48:26
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/05 12:59:34 (permalink)
0
Thanks for all the help. If I type:
 
sudo /sbin/route add default -interface ppp0
 
I get the following result:

route: writing to routing socket: File exists
add net default: gateway ppp0: File exists
 
 
ifconfig -a states:
 
...
ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1354
inet .....IP-ADRESS...... --> 1.1.1.1 netmask 0xff000000
post edited by logimano - 2015/10/05 13:00:41
#42
brudy
New Member
  • Total Posts : 11
  • Scores: 2
  • Reward points: 0
  • Joined: 2011/12/03 11:26:16
  • Location: Switzerland
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/05 13:03:06 (permalink)
0
In this case you already send all your traffic into the tunnel.
 
can you do a "netstat -rn" then you should see 2 times default. One going to your real gateway and another going to your ppp0 interface.
#43
logimano
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/10/05 01:48:26
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/05 13:48:50 (permalink)
0
Destination Gateway Flags Refs Use Netif Expire
default 192.168.1.1 UGSc 24 0 en0
1.1.1.1 <vpnipadress> UH 4 0 ppp0
<otheripaddress1>/32 1.1.1.1 UGSc 1 0 ppp0
<otheripaddress2>/24 1.1.1.1 UGSc 2 0 ppp0
#44
Sridhar
New Member
  • Total Posts : 11
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/10/01 02:30:46
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/05 17:23:43 (permalink)
0
brudy
I just tried El Capitan with the built in Cisco IPSec VPN client. Same behavior. IP does work, DNS fails. 
 
In this case no 3rd party software is involved. It is pure Mac. Looks like the problem needs to fixed in El Capitan and not in the FortiClient.
 




For me, FortiClient 4.0.2082 works without major issues in El Capitan. I think this issue might be the result of some major networking changes in El Capitan.
#45
lubyou
Bronze Member
  • Total Posts : 27
  • Scores: 4
  • Reward points: 0
  • Joined: 2011/01/05 00:57:21
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/06 03:43:56 (permalink)
0
Tech support
Currently there is no supported version of FortiClient for Mac OS X 10.11 El Capitan.
 
The following table lists FortiClient (Mac OS X) 5.2.4 product integration and support information.
Desktop Operating Systems
l Mac OS X v10.8 Mountain Lion
l Mac OS X v10.9 Mavericks
l Mac OS X v10.10 Yosemite
 
The next version of FortiClient has a tentative release date of the 2nd week of October.

 
According to tech support...
#46
Sridhar
New Member
  • Total Posts : 11
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/10/01 02:30:46
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/06 03:55:04 (permalink)
0
lubyou
Tech supportCurrently there is no supported version of FortiClient for Mac OS X 10.11 El Capitan. The following table lists FortiClient (Mac OS X) 5.2.4 product integration and support information.Desktop Operating Systemsl Mac OS X v10.8 Mountain Lionl Mac OS X v10.9 Mavericksl Mac OS X v10.10 Yosemite The next version of FortiClient has a tentative release date of the 2nd week of October.
 According to tech support...



Second week of Oct doesn't sound bad, provided they have a fix for this issue.
#47
patz@procergs.rs.gov.br
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/10/06 04:59:35
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/06 05:29:31 (permalink)
0
Hi..
 
I tried to use forticlient on: MAC v10.9, v10.10 and v10.11. All of them install the client, I can connect in a VPN using IPSEC but the traffic doesn´t pass from MAC to VPN. I´ve a opened ticket with Fortinet and Engineer doesn´t solve this.
 
Does anyone see this problem?
 
#48
Chris.Lin_FTNT
Gold Member
  • Total Posts : 310
  • Scores: 35
  • Reward points: 0
  • Joined: 2012/11/19 14:12:49
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/06 10:56:39 (permalink)
5 (2)
There seems to be issue with 10.11 resolver. When it sends DNS request through tunnel, it uses the IP from physical interface, instead of the tunnel interface.
 
We opened a ticket with Apple and we are waiting for their response.
#49
patz@procergs.rs.gov.br
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/10/06 04:59:35
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/06 10:59:22 (permalink)
0
To me... I can´t ping any IP Address. And If I use this same connection on Windows all work fine..
#50
lubyou
Bronze Member
  • Total Posts : 27
  • Scores: 4
  • Reward points: 0
  • Joined: 2011/01/05 00:57:21
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/06 11:04:04 (permalink)
0
Chris.Lin
There seems to be issue with 10.11 resolver. When it sends DNS request through tunnel, it uses the IP from physical interface, instead of the tunnel interface.
 
We opened a ticket with Apple and we are waiting for their response.




That means that the upcoming Forticlient release will not have a fix for the DNS issue on 10.11, does it not?
 
patz@procergs.rs.gov.br
Hi..
 
I tried to use forticlient on: MAC v10.9, v10.10 and v10.11. All of them install the client, I can connect in a VPN using IPSEC but the traffic doesn´t pass from MAC to VPN. I´ve a opened ticket with Fortinet and Engineer doesn´t solve this.
 
Does anyone see this problem?

 
Seeing how you encounter issues on OS X 10.9-10.11, I do not see how your problem relates to the rest of the thread.
Possibly open another thread and provide details, incl. a proper problem description, config details etc.
#51
logimano
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/10/05 01:48:26
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/07 00:12:03 (permalink)
0
For me, I have downgraded back to Yosemite via Time Machine (Cmd+R at boot) because I need FortiClient in my daily work. In Yosemite, everything with FortiClient works fine.
post edited by logimano - 2015/10/07 05:38:38
#52
Chris.Lin_FTNT
Gold Member
  • Total Posts : 310
  • Scores: 35
  • Reward points: 0
  • Joined: 2012/11/19 14:12:49
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/07 09:44:54 (permalink)
0
The resolver issue in Mac OS X 10.11 can be verified without VPN:
 
For example if you have two network cards (LAN and WIFI), you manually add a route to the DNS server through the non primary interface, "ping www.google.com" will generate DNS traffic through the non primary interface (correct), however the source IP of the packet will still be the primary interface (incorrect), thus no reply will come back.
#53
richard451
New Member
  • Total Posts : 3
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/10/01 12:53:09
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/08 12:29:41 (permalink)
0
Are you saying it can't/won't be fixed until Apple provides a fix?
 
Couldn't this also be fixed by changing Fortinet to have the VPN show up as an adapter in the Network configuration (then a user can just change the dns easily)?
#54
Sridhar
New Member
  • Total Posts : 11
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/10/01 02:30:46
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/09 19:33:41 (permalink)
0
I get the below crash quite often. I was of an assumption that it was due to El Capitan, but upon looking into the dump trace, I see its because of Fortinet. Anyone else having this issue?
 
Anonymous UUID: E140DDC2-C2B4-3072-FB84-FD286608ECDB
Sat Oct 10 07:41:13 2015
*** Panic Report ***
panic(cpu 2 caller 0xffffff8016dd6a9a): Kernel trap at 0xffffff801704ccac, type 13=general protection, registers:
CR0: 0x000000008001003b, CR2: 0x0000209b81023000, CR3: 0x000000001a463000, CR4: 0x00000000001627e0
RAX: 0xdeadbeefdeadbeef, RBX: 0xffffff8037052630, RCX: 0xffffffffe856dc50, RDX: 0x0000000000000001
RSP: 0xffffff82009b3900, RBP: 0xffffff82009b3980, RSI: 0x0000000000000002, RDI: 0xffffff8036d49f80
R8: 0xffffff8036d47000, R9: 0xffffff804fbb47e0, R10: 0x0000000000000238, R11: 0xffffff81f8da9fbc
R12: 0xffffff804fbb41c0, R13: 0x0000000000000001, R14: 0xffffff804fbb47e0, R15: 0xffffff80370521a8
RFL: 0x0000000000010282, RIP: 0xffffff801704ccac, CS: 0x0000000000000008, SS: 0x0000000000000010
Fault CR2: 0x0000209b81023000, Error code: 0x0000000000000000, Fault CPU: 0x2, PL: 0
Backtrace (CPU 2), Frame : Return Address
0xffffff81f7055df0 : 0xffffff8016ce5357
0xffffff81f7055e70 : 0xffffff8016dd6a9a
0xffffff81f7056050 : 0xffffff8016df4093
0xffffff81f7056070 : 0xffffff801704ccac
0xffffff82009b3980 : 0xffffff80170499f8
0xffffff82009b3d90 : 0xffffff80170363d7
0xffffff82009b3de0 : 0xffffff8017037913
0xffffff82009b3f40 : 0xffffff8016f6d58c
0xffffff82009b3fb0 : 0xffffff8016dd14b7
BSD process name corresponding to current thread: kernel_task
Boot args: kext-dev-mode=1
Mac OS version:
15A284
Kernel version:
Darwin Kernel Version 15.0.0: Wed Aug 26 16:57:32 PDT 2015; root:xnu-3247.1.106~1/RELEASE_X86_64
Kernel UUID: 37BC582F-8BF4-3F65-AFBB-ECF792060C68
Kernel slide: 0x0000000016a00000
Kernel text base: 0xffffff8016c00000
__HIB text base: 0xffffff8016b00000
System model name: MacBookPro11,3 (Mac-2BD1B31983FE1663)
System uptime in nanoseconds: 3124454776600
last loaded kext at 25524518244: com.fortinet.fct.kext.fctapnke 1 (addr 0xffffff7f99c6b000, size 401408)
last unloaded kext at 1354301372607: com.apple.driver.AppleXsanScheme 3 (addr 0xffffff7f9920c000, size 40960)
loaded kexts:
com.fortinet.fct.kext.fctapnke 1
com.kaspersky.kext.klif 3.0.2a239
com.apple.driver.AppleMikeyHIDDriver 124
com.apple.driver.AppleHWSensor 1.9.5d0
com.apple.driver.AudioAUUC 1.70
com.apple.filesystems.autofs 3.0
com.apple.driver.AGPM 110.20.19
com.apple.driver.ApplePlatformEnabler 2.5.1d0
com.apple.driver.X86PlatformShim 1.0.0
com.apple.driver.AppleOSXWatchdog 1
com.apple.driver.AppleGraphicsDevicePolicy 3.7.7
com.apple.driver.AppleHDA 272.50
com.apple.driver.pmtelemetry 1
com.apple.iokit.IOUserEthernet 1.0.1
com.apple.driver.AppleUpstreamUserClient 3.6.1
com.apple.iokit.IOBluetoothSerialManager 4.4.0f4
com.apple.Dont_Steal_Mac_OS_X 7.0.0
com.apple.GeForce 10.0.6
com.apple.driver.AppleIntelHD5000Graphics 10.0.8
com.apple.driver.AppleHV 1
com.apple.driver.AppleMCCSControl 1.2.13
com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport 4.4.0f4
com.apple.driver.AppleIntelSlowAdaptiveClocking 4.0.0
com.apple.driver.AppleSMCLMU 208
com.apple.driver.AppleIntelFramebufferAzul 10.0.8
com.apple.driver.AppleLPC 3.1
com.apple.driver.AppleCameraInterface 5.41.0
com.apple.driver.AppleMuxControl 3.11.31
com.apple.driver.AppleThunderboltIP 3.0.8
com.apple.driver.AppleUSBCardReader 3.7.1
com.apple.driver.AppleUSBTCButtons 245.4
com.apple.driver.AppleUSBTCKeyboard 245.4
com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1
com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0
com.apple.BootCache 37
com.apple.iokit.IOAHCIBlockStorage 2.8.0
com.apple.driver.AppleAHCIPort 3.1.5
com.apple.driver.AirPort.Brcm4360 1000.13.1a3
com.apple.driver.AppleSmartBatteryManager 161.0.0
com.apple.driver.AppleACPIButtons 4.0
com.apple.driver.AppleRTC 2.0
com.apple.driver.AppleHPET 1.8
com.apple.driver.AppleSMBIOS 2.1
com.apple.driver.AppleACPIEC 4.0
com.apple.driver.AppleAPIC 1.7
com.apple.nke.applicationfirewall 163
com.apple.security.quarantine 3
com.apple.security.TMSafetyNet 8
com.apple.kext.triggers 1.0
com.apple.driver.DspFuncLib 272.50
com.apple.kext.OSvKernDSPLib 525
com.apple.iokit.IOSerialFamily 11
com.apple.nvidia.driver.NVDAGK100Hal 10.0.6
com.apple.nvidia.driver.NVDAResman 10.0.6
com.apple.driver.CoreCaptureResponder 1
com.apple.iokit.IOSurface 108.0.1
com.apple.driver.AppleSMBusController 1.0.14d1
com.apple.iokit.IOBluetoothHostControllerUSBTransport 4.4.0f4
com.apple.iokit.IOBluetoothFamily 4.4.0f4
com.apple.driver.AppleHDAController 272.50
com.apple.iokit.IOHDAFamily 272.50
com.apple.iokit.IOAudioFamily 203.8
com.apple.vecLib.kext 1.2.0
com.apple.iokit.IOSlowAdaptiveClockingFamily 1.0.0
com.apple.AppleGraphicsDeviceControl 3.11.31
com.apple.iokit.IOAcceleratorFamily2 203.7.1
com.apple.driver.AppleBacklightExpert 1.1.0
com.apple.iokit.IONDRVSupport 2.4.1
com.apple.driver.AppleGraphicsControl 3.11.31
com.apple.iokit.IOGraphicsFamily 2.4.1
com.apple.driver.X86PlatformPlugin 1.0.0
com.apple.driver.AppleSMC 3.1.9
com.apple.driver.IOPlatformPluginFamily 6.0.0d7
com.apple.iokit.IOSCSIBlockCommandsDevice 3.7.7
com.apple.iokit.IOUSBMassStorageDriver 1.0.0
com.apple.iokit.IOSCSIArchitectureModelFamily 3.7.7
com.apple.driver.AppleUSBMultitouch 250.4
com.apple.iokit.IOUSBHIDDriver 900.4.1
com.apple.driver.usb.AppleUSBHostCompositeDevice 1.0.1
com.apple.driver.usb.AppleUSBHub 1.0.1
com.apple.driver.CoreStorage 517
com.apple.iokit.IOAHCIFamily 2.8.0
com.apple.driver.AppleThunderboltDPInAdapter 4.1.2
com.apple.driver.AppleThunderboltDPAdapterFamily 4.1.2
com.apple.driver.AppleThunderboltPCIDownAdapter 2.0.2
com.apple.driver.AppleThunderboltNHI 4.0.1
com.apple.iokit.IOThunderboltFamily 5.0.6
com.apple.iokit.IO80211Family 1100.23
com.apple.driver.mDNSOffloadUserClient 1.0.1b8
com.apple.iokit.IONetworkingFamily 3.2
com.apple.driver.corecapture 1.0.4
com.apple.driver.usb.AppleUSBXHCIPCI 1.0.1
com.apple.driver.usb.AppleUSBXHCI 1.0.1
com.apple.iokit.IOUSBFamily 900.4.1
com.apple.iokit.IOUSBHostFamily 1.0.1
com.apple.driver.AppleUSBHostMergeProperties 1.0.1
com.apple.driver.AppleEFINVRAM 2.0
com.apple.driver.AppleEFIRuntime 2.0
com.apple.iokit.IOHIDFamily 2.0.0
com.apple.iokit.IOSMBusFamily 1.1
com.apple.security.sandbox 300.0
com.apple.kext.AppleMatch 1.0.0d1
com.apple.driver.AppleKeyStore 2
com.apple.driver.AppleMobileFileIntegrity 1.0.5
com.apple.driver.AppleCredentialManager 1.0
com.apple.driver.DiskImages 414
com.apple.iokit.IOStorageFamily 2.1
com.apple.iokit.IOReportFamily 31
com.apple.driver.AppleFDEKeyStore 28.30
com.apple.driver.AppleACPIPlatform 4.0
com.apple.iokit.IOPCIFamily 2.9
com.apple.iokit.IOACPIFamily 1.4
com.apple.kec.Libm 1
com.apple.kec.pthread 1
com.apple.kec.corecrypto 1.0
Model: MacBookPro11,3, BootROM MBP112.0138.B15, 4 processors, Intel Core i7, 2.3 GHz, 16 GB, SMC 2.19f12
Graphics: Intel Iris Pro, Intel Iris Pro, Built-In
Graphics: NVIDIA GeForce GT 750M, NVIDIA GeForce GT 750M, PCIe, 2048 MB
Memory Module: BANK 0/DIMM0, 8 GB, DDR3, 1600 MHz, 0x02FE, -
Memory Module: BANK 1/DIMM0, 8 GB, DDR3, 1600 MHz, 0x02FE, -
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x134), Broadcom BCM43xx 1.0 (7.21.94.25.1a3)
Bluetooth: Version 4.4.0f4 16320, 3 services, 19 devices, 1 incoming serial ports
Network Service: Wi-Fi, AirPort, en0
Serial ATA Device: APPLE SSD SM0512F, 500.28 GB
USB Device: USB 3.0 Bus
USB Device: Apple Internal Keyboard / Trackpad
USB Device: BRCM20702 Hub
USB Device: Bluetooth USB Host Controller
Thunderbolt Bus: MacBook Pro, Apple Inc., 17.1
#55
brudy
New Member
  • Total Posts : 11
  • Scores: 2
  • Reward points: 0
  • Joined: 2011/12/03 11:26:16
  • Location: Switzerland
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/09 21:47:51 (permalink)
0
Tonight FortiClient 5.4 was released, which supports El Capitan. Give it a try.
 
Anyway the DNS problem still exists, as you can see in the release notes, because it is an Apple problem. 
#56
jweber
New Member
  • Total Posts : 16
  • Scores: 2
  • Reward points: 0
  • Joined: 2014/10/31 08:38:58
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/09 22:11:39 (permalink)
0
Thanks for the update. The release notes here mention a workaround for the DNS problem:
"use a public DNS, so that all DNS traffic goes through the public interface"
Can you explain how you would do that? Any response from Apple yet?
#57
Sridhar
New Member
  • Total Posts : 11
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/10/01 02:30:46
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/09 22:12:28 (permalink)
0
brudy
Tonight FortiClient 5.4 was released, which supports El Capitan. Give it a try.
 
Anyway the DNS problem still exists, as you can see in the release notes, because it is an Apple problem. 


Would you mind linking it here? I am not able to find 5.4 anywhere.
Thanks in advance.
#58
emnoc
Expert Member
  • Total Posts : 5769
  • Scores: 375
  • Reward points: 0
  • Joined: 2008/03/20 13:30:33
  • Location: AUSTIN TX AREA
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/10 12:13:15 (permalink)
0
FWIW login and go to downloads on the support website. Release notes  dmg files exists.
 
 

PCNSE 
NSE 
StrongSwan  
#59
Chris.Lin_FTNT
Gold Member
  • Total Posts : 310
  • Scores: 35
  • Reward points: 0
  • Joined: 2012/11/19 14:12:49
  • Status: offline
Re: FortiClient VPN Problems With OSX 10.11 El Capitan 2015/10/13 11:26:15 (permalink)
0
One very experienced Mac user mentioned how he changed the solver manually to make the DNS work. It may worth a try.
 
"Initial prep:
$ mkdir ~/resolver
$ echo ""nameserver 172.16.100.100"" > ~/resolver/ca
(repeat for com, org and any other TLDs you need to access)
$ sudo mkdir /etc/resolver
After connecting to SSLVPN:
$ sudo cp ~/resolver/* /etc/resolver
When disconnecting from SSLVPN:
$ sudo rm /etc/resolver/*
For some reason, this works, even though /etc/resolv.conf's contents have
no effect.
"
#60
Page: < 12345.. > >> Showing page 3 of 8
Jump to:
© 2020 APG vNext Commercial Version 5.5