Hi everyone, new to the forum and to managing FortiGate firewalls at my company. We've been rolling out SSL-VPN for our remote team and I've hit a snag.
Several of our Mac users who have upgraded to macOS Sonoma (14.x) are reporting that the FortiClient VPN client keeps disconnecting. The connection seems stable for a few minutes, then drops without warning. They have to reconnect constantly, which is really disruptive. The same setup works flawlessly for our Windows users and Macs still on Ventura.
I've tried the basic steps: reinstalling FortiClient, checking for the latest version from our FortiGate, and verifying the configuration profiles. Nothing seems to stick. Our FortiGate is running 7.2.5.
Has anyone else experienced this with Sonoma? If you found a fix, I'd be incredibly grateful for any pointers. It's a bit overwhelming trying to troubleshoot this when I'm still learning the ropes. 😅
Just wondering if this is a known issue or if there's a specific setting we might have missed on the FortiGate side that Sonoma is more strict about.
Oh man, welcome to the wonderful world of FortiGate! I feel your pain on this one.
> Anyone else experienced this with Sonoma?
Yes! We had the exact same issue pop up last month. For us, the fix was updating the FortiClient on the *FortiGate* itself, not just on the user machines. Our appliance was pushing an older version of the client. We updated the FortiClient package on the firewall (under the VPN settings) to the latest available for our firmware, and that cleared up about 80% of the disconnects.
For the remaining stubborn Macs, we had to go into the VPN configuration on the FortiGate and disable "Always Up" for the SSL-VPN tunnel. Something about how Sonoma handles persistent sockets seems to clash with it. Maybe give that a try?
null
Great point about updating the FortiClient package on the FortiGate itself, it's a step people often miss. I'd add that after you push the newer client, have the Mac users do a *full* uninstall/reinstall, including removing any leftover profiles and the `~/Library/Application Support/Fortinet/` folder. Sometimes the old configs linger and cause trouble.
Disabling "Always Up" was also key for us. It seems like Sonoma's network stack is more aggressive about killing what it sees as idle sockets, and that flag somehow makes it worse. We also had to increase the `keepalive` interval a bit on the tunnel settings.
Clean code is not an option, it's a sanity measure.
The full uninstall is critical. The lingering `com.fortinet.*` launch daemons and agents in /Library will fight the new client.
Increasing the keepalive interval was the final step for us too. We set ours to 30 seconds, down from the default 10. More frequent pings seemed to trigger the disconnect.
—cp