Is ISP blocking my Forticlient?

[TJNIHAL]

Hi,  I have FG60D and FG60E Devices and I'm not a networking guy I have been planned to implement Forticlient for our end users I successfully configured Forticlient following this https://www.youtube.com/watch?v=peDdJuuoLrU after I keep receiving this error "Please check your configuration, network connection and pre-shared key then try your connection.

So, as I am having two ISP connections and I tried with another but same error later I tried with another firewall just brought FG60E but in this also same error  So, I contact Fortinet support one amazing guy verified all my setting quickly and said my public ip is not pinging from outside network he use this command "diag sniffer packet any "host publicip" 4 0 a no packet received  So, How I have to tell my ISP what is blocking my Forticlient in his side? Thanks in advance,

[ede_pfau]

Guessing that you want to use an IPsec VPN, these ports need to be open towards your FGT:

- udp/500 and udp/4500 if the FGT or the FortiClient are behind a NAT router (which you can safely assume)

- ping (protocol is ICMP) is NOT needed or used

With the sniffer command you posted you can always monitor if ANY traffic is reaching your FGT, be it ping or IPsec requests.

In fact, as all public IP addresses are attacked sooner or later, you should be some traffic at any time. If not, your FGT literally is not connected, or at least not connected for incoming connections.

Maybe your ISP rules out incoming connections and only allows browsing, email etc. that is, outgoing connections.

[DingDong]

I think you need to set up SSL-VPN portal, this works for me for years. I don't think I ever worked with IPsec which the youtube video explains.

Many settings would be same or similar, anyways for SSL-VPN:

First of all, ping must not be available on the public interface.

Second, please make sure you do not use the same port as on the management interface, say, if you log on to your Fortigate using https and port 443, you need to connect to the SSL-VPN portal using a different port (e.g. 10443).

Then, if you are testing the connection from the client and the client is in the internal network, make sure there is a policy from the internal network to the public interface that allows packets on this port to pass.

You can also try to access your SSL-VPN portal in a browser using https://<publicIpOfTheInterface>:<Port>/ of course only if your portal is configured for tunnel mode as well as for web mode.

Some settings might be similar for SSL-VPN as well as for IPsec. See if that helps.

Maybe provide some more details or Screenshots of your settings and client.

[emnoc]

Fortigate using https and port 443, you need to connect to the SSL-VPN portal using a different port (e.g. 10443).

if the ISP is blocking connection than port 10443 is not what I would use for sslvpn  btw.