Forticlient VPN not working with hotspot

Understanding the typical symptoms

• VPN connects but stalls at a percentage (often around 98%) and times out.
• The tunnel appears to establish, but no traffic passes through.
• Connection succeeds on Wi‑Fi but fails on a mobile hotspot.
• Reproducible failures across different devices when using the same hotspot.

These patterns point toward how mobile hotspots allocate addresses, handle NAT, and manage data packets. FortiClient may complete the SSL/TLS handshake or phase-1/phase-2 negotiation, but subsequent packet routing fails if the hotspot’s network path is restrictive or if MTU/DNS settings clash with VPN requirements.

Common culprits and quick checks

• MTU (Maximum Transmission Unit) mismatches
• Many hotspots default to MTU values that are too large for VPN encapsulation (e.g., IPv4 over IPsec or SSL VPN). This can cause fragmentation issues or dropped packets after the VPN handshake.
• NAT and CGNAT limitations
• Carrier-grade NAT can complicate VPN traffic, especially for IPsec/L2TP or SSL VPN. Some hotspots expose only a single external IP, which can hinder certain tunnels.
• DNS resolution issues
• If the hotspot’s DNS setup is flaky or slow, domain lookups used during VPN phase negotiations can stall.
• Firewall or carrier restrictions
• Some mobile networks block or throttle VPN ports or VPN protocols (UDP/TCP differences, or specific IPsec/SSL ports), leading to unstable connections.
• VPN mode and protocol compatibility
• FortiClient supports multiple VPN types (SSL-VPN, IPsec). The hotspot may work better with one protocol over another.

Step-by-step troubleshooting guide

1. Verify the basic connectivity on the hotspot
   • Ensure the phone’s hotspot is actively sharing data with a stable signal.
   • Test general internet access (browse, streaming) to confirm the data path is usable.
   • Note the carrier’s behavior: some carriers penalize certain VPN types with throttling or blocking.
2. Check FortiClient VPN mode
   • Confirm you are using the recommended VPN type for your gateway (SSL-VPN vs IPsec).
   • If you have the option, switch to the other protocol to see if connectivity improves.
3. Adjust MTU settings
   • On the device connected to the hotspot, try reducing MTU:
   • Windows: set MTU in the active network adapter properties or via command line (e.g., netsh interface ipv4 show subinterfaces to find the interface, then netsh interface ipv4 set subinterface "Interface Name" mtu=1450 store=persistent).
   • macOS: System Preferences > Network > Advanced > TCP/IP tab. Manually set MTU (e.g., 1400–1440).
   • Android/iOS: Some VPN apps allow MTU tuning in advanced settings. If not, try lowering the hotspot’s effective MTU by limiting the phone’s data channel settings or enabling “WLAN + USB tethering” where available.
   • Start with a modest reduction, e.g., 1400, and test FortiClient again. If it improves, gradually increase to find a stable value.
4. test with a different network path
   • If possible, connect the FortiClient VPN via a different hotspot (another carrier or a different device) to see if the issue is consistent across networks.
   • Try a tethered USB modem or a portable Wi‑Fi hotspot device separate from a phone to rule out phone-specific quirks.
5. DNS and probe basic certificate trust
   • Ensure the device’s DNS resolver can reach Fortinet’s gateway domain. Temporarily set DNS to a reliable public resolver (1.1.1.1 or 9.9.9.9).
   • Verify that there are no certificate trust issues by confirming the FortiGate certificate chain is presented and trusted by the device.
6. Inspect FortiClient logs and gateway status
   • Open FortiClient and enable verbose logging if available.
   • Look for errors during phase 1/2, timeouts, or handshake failures.
   • Compare logs when connected to a stable network (Wi‑Fi) vs hotspot to identify where the breakdown occurs.
7. Firewall, port, and protocol considerations
   • SSL-VPN typically uses port 443 or 8443; IPsec uses UDP ports 500/4500. If your hotspot or carrier blocks nonstandard VPN ports, you may need to configure FortiGate to listen on standard ports or switch VPN type.
   • If your gateway supports both SSL-VPN and IPsec, experiment with which one is less likely to be blocked by the carrier.
8. Battery saving and hotspot behavior
   • On some devices, power or network optimizations can intermittently drop VPN connections.
   • Disable features like “Low Power” or aggressive data-saving modes on both the hotspot device and the client device.
   • Keep the phone or hotspot plugged in if possible to maintain a stable connection.
9. Update firmware and apps
   • Ensure FortiClient is up to date with the latest stable release.
   • Check the hotspot device firmware for updates, as newer firmware can improve NAT handling and stability.
   • Update the mobile OS on the hotspot host to the latest version.

A practical comparison: SSL-VPN vs IPsec over hotspot

Notes:

• If SSL-VPN stalls at 98%, trying IPsec (if supported by your gateway) can reveal whether the problem is protocol-specific.
• Conversely, if IPsec fails similarly, the issue is more likely the network path than the protocol.

When to seek further help

• If you consistently observe failure across multiple hotspots but can connect on a wired network or home Wi‑Fi, the issue is likely carrier or hotspot-specific. Contact the hotspot provider or carrier to inquire about VPN traffic policies or CGNAT behaviors.
• If you can reproduce the issue on multiple devices with the same hotspot, gather logs and contact Fortinet support or the gateway administrator with details:
• FortiClient version
• VPN type (SSL-VPN or IPsec)
• Gateway address and certificate details
• MTU value tested and observed results
• Phone/model of hotspot device and carrier

Practical tips from user experiences

• A common workaround is to lower the MTU to values around 1400 or 1380 and retry the VPN. This can resolve fragmentation issues causing stalls.
• Some users report success by disabling a feature called Maximize Compatibility on iPhone Personal Hotspot, though this is device-specific and may vary with iOS versions.
• Others find that using a different hotspot device or carrier eliminates the problem, confirming a network-path issue rather than software.

Quick-start checklist

• Confirm hotspot connectivity by browsing and streaming tests.
• Try SSL-VPN and, if possible, IPsec to compare behavior.
• Reduce MTU to around 1400 and re-test FortiClient.
• Change DNS on the client to a fast resolver (1.1.1.1 or 9.9.9.9).
• Review FortiClient logs for handshake or tunnel establishment issues.
• Check for hotspot and device firmware updates.
• If consistently failing, test with another hotspot or carrier to isolate the cause.

Recommendation

If you’re frequently using FortiClient VPN with a hotspot and you encounter stalling at around 98% or failed connections, start with MTU adjustment and protocol testing. Reduce MTU to a conservative value (around 1400) and try SSL-VPN first. If needed, switch to IPsec if supported by your gateway. Keep DNS tidy, update software, and test across different networks to identify whether the issue is device, hotspot, or carrier related. If the problem persists after these steps, escalate with Fortinet support or your gateway administrator, including detailed logs and the exact network conditions you’ve tested.