12

I am trying to connect to the office VPN but it requires forticlient.

Not able to find a package for Ubuntu 20.04

1
  • 1
    There is a .deb here. Doesn't work?
    – xenoid
    Jun 9, 2020 at 15:43

13 Answers 13

10

Forticlient is not available through ubuntu repository. You can download (as of now 6.4 version) and install manually by executing below commands in terminal.

wget -c 'https://filestore.fortinet.com/forticlient/downloads/FortiClientFullVPNInstaller_6.4.0.0851.deb' 

sudo dpkg -i FortiClientFullVPNInstaller_6.4.0.0851.deb
3
  • 2
    It has an option for only SSL-VPN.
    – Thirumal
    Jul 13, 2020 at 14:45
  • 2
    sudo dpkg -i FortiClientFullVPNInstaller_6.4.0.0851.deb ``` Selecting previously unselected package forticlient. (Reading database ... 241197 files and directories currently installed.) Preparing to unpack FortiClientFullVPNInstaller_6.4.0.0851.deb ... Unpacking forticlient (6.4.0.0851) ... dpkg: dependency problems prevent configuration of forticlient: forticlient depends on libappindicator1 (>> 0); however: Package libappindicator1 is not installed. forticlient depends on libgconf-2-4 (>> 0); however: Package libgconf-2-4 is not installed.``` Oct 6, 2020 at 18:57
  • 1
    You can fix dependency by sudo apt install -f
    – KK Patel
    Oct 19, 2020 at 11:03
8

Did you have problems using openfortivpn?

You can install it with:

sudo apt install openfortivpn

then run it from the terminal with:

sudo openfortivpn <host>:<port> -u<username>
1
  • This works great, thanks Jun 9, 2021 at 16:08
5

I faced this problem recently. On Windows I used Fortinet VPN client but Ubuntu version of their client have no IPSec support (at time of writing this).

For those looking for Ubuntu/Linux Mint 20 VPN client to connect to FortiNET VPN using IPSec, IKEv1, PSK (pre-shared-key) and the extended authentication (XAUTH) with your account and password, I found vpnc the easiest to use via gnome gui. In my case strongswan gnome gui did not work. I think because it uses IKEv2 and I need IKEv1.

# install dependencies
sudo apt-get install vpnc vpnc-scripts network-manager-vpnc network-manager-vpnc-gnome

Note that in vpnc-gnome interface the group id is group name, pre-shared-key is group password. In the advanced tab, look in the windows version of (working) Fortinet VPN client what values are used for the encryption, NAT-traversal and DH group. The names are not identical but the values you should select are. In my case the default values from vpnc gui were not what I needed.

1
  • And what would be Groud ID/Group Name. I don't see this in my forticlient on windows
    – chesterman
    Sep 9, 2021 at 14:28
1

On Ubuntu 20.04 I found the best method has been the one I used on my previous answer

And for using with forticlient vpn ipsec I found this very useful:

Instructions for configuration for Forticlient vpn ipsec

1

Reading this topic, I was able to connect to the "standard Fortigate IKEv1 IPSEC VPN for Mobile client" .

It works with the following parameters if on the Fortigate, the VPN was created using the wizard (and no particular tuning had been done)

So, following this if you are under Linux make it easy to connect the standard IPSEC mobile VPN the Fortigate wizard create.

It can be use where Forticlient Linux is not usable (it do not have IPSEC tab to configure a mobile IPSEC access)

Thanks to Dusan Mijatovic for it previous post on this page.

Here is how to configure :

install network-manager-vpnc-gnome or network-manager-vpnc-kde or network-manager-vpnc depending on your desktop (use yum, apt or whatever packet manager of your distrib or build it from source)

  • open your connection manager and add a new VPN connection
  • Select VPNC for the type of the VPN connexion
  • give a name to your connection
  • fullfill gateway, user & password
  • groupe name = "ipsec group id" = 0 (<= Here you need to put 0)
  • groupe password = "ipsec psk" = yourpsk (<= Here put the PSK)
  • in advanced tab :
    • set tunnel interface name = myvpn-ike
    • Cryptographic methode = Secure (default)
    • NAT-TRAVERSAL = NAT-T if availiable (default)
    • Group DH IKE = Group DH 5
    • PFS (Perfect Forward Secrecy) = Group DH 5
    • Local Port = 0
    • Select disable DPD (tic the box)
    • Let all others parameters empty or to their default values

Save the new connection and simply start it from your desktop connection manager.

You may find a handshake error in logs but it's not a real problem, the connection work.

The error is: "org.gnome.Shell.desktop[7849]: [1176:1192:1022/090523.496193:ERROR:ssl_client_socket_impl.cc(981)] handshake failed; returned -1, SSL error code 1, net_error -202"

Hope it will help Linux user to EASILY connecting FortiGate IPSEC mobile VPN which is automaticaly created by Fortigate wizard. (FortiGate support TAC do not help on this problem, they do not know that there are differences between FortiClientVPN Windows and FortiClientVPN Linux)

Regards

2
  • I'm trying to do this now - the vpnc create dialog does not allow me to input a password or a group password - the fields are greyed out. Is there a reason for this? Jun 8, 2022 at 16:52
  • @Brydon Gibson : Is your 'unix' user allowed to manage network ? I had sucessfully tested it on several Linux distributions and more particulary under Debian 10 and Debian 11
    – nbanba
    Nov 22, 2022 at 18:03
1

Sorry to post twice in the same day, but I think lots of people wants to help but do not have properly understand the issue we're disscuss here.

Sorry for everybody suggesting to install the official FortiClient but it DO NOT solve the problem here. Fortinet TAC support confirm it on case #5378335 which was closed by TAC on 2021-10-11 with no other solution that open an NFR (New Feature Request) at Fortinet's developpers team.

Forticlient Linux do not include the capability to connect a MOBILE IPSEC IKEv1 vpn endpoint with a username, a password and a PSK.

This type of VPN is automatically created when using FortiGate vpn wizard to create a vpn endpoint for mobile client. The wizard create a MOBILE IPSEC IKEv1 tunnel and Forticlient Linux do not provide an interface to connect an IPSEC VPN (But Forticlient Windows does).

Forticlient Linux is only design to connect Fortigate SSL VPN which is a "ppp" VPN using SSL.

So if you need to connect a FortiGate VPN with cerdential AND a psk, you're not connecting an SSL VPN but an IPSEC IKEv1 mobile VPN and so you cannot use Forticlient. If your in the case you need to connect such VPN, you can succeed easily using instruction I post earlier on this topic today.

Hope it could help people which cannot connect a FortiGate VPN using credential and a PSK.

Kind regards, nbanba

0

Here is the link of forticlient download page. downlaod from here. Download .deb package and install it using

sudo dpkg -i <debfile name>
1
  • It is not working I tried many times
    – Thirumal
    Jul 13, 2020 at 8:49
0

There is detailed information here about how to add a repository so it can be installed with apt.

https://www.forticlient.com/repoinfo

Even though it says Ubuntu 18.04, I'd say it's 99% likely it will work on Ubuntu 20.04.

1
  • It is not working on 20.04
    – goodfellow
    Oct 9, 2020 at 2:59
0

I've had success a while ago with StrongSWAN and these settings (replace the placeholders in double parentheses):

conn fortinet
    left=%any
    leftauth=psk
    leftid=""
    leftauth2=xauth
    xauth_identity="((your username))"
    leftsourceip=%config
    right=((gateway IP address))
    rightsubnet=((VPN subnet))
    rightauth=psk
    keyexchange=ikev1
    aggressive=yes
    ike=aes128-sha1-modp1536!
    esp=aes128-sha1-modp1536!
    auto=add
0

Installation

I was able to install it using the following commands:

wget -O - https://repo.fortinet.com/repo/7.0/ubuntu/DEB-GPG-KEY | \
gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/forticlient.gpg

sudo apt update

sudo apt install forticlient

Notes: this solution was adapted from the official website, which unfortunately has the following problems:

  • The place where it downloads the key from retrieves an expired key;
  • It uses the deprecated apt-key approach to add the gpg key.

Edit - instructions in case the program doesn't open

In my case, I noticed after running forticlient in the command line that it returns me the following output:

[...]
18:52:34.344 › Saml - init
[87259:0816/185235.638271:FATAL:gpu_data_manager_impl_private.cc(445)] GPU process isn't usable. Goodbye.
[2]    87259 trace trap (core dumped)  forticlient

What happens is that FortiClient is built in Electron and this GPU problem is a common issue in Electron-based programs that use the sandbox feature.

Disabling it using the flag --disable-gpu-sandbox makes the program work.

To make the desktop program open as well, the following can be done:

# Use your favorite editor (vim, nano...) to edit the desktop entry
sudo vim /usr/share/applications/forticlient.desktop

Go to the line that looks like this:

Exec=/opt/forticlient/gui/FortiClient-linux-x64/FortiClient

Then add the flag to the end of it:

Exec=/opt/forticlient/gui/FortiClient-linux-x64/FortiClient --disable-gpu-sandbox

Save the file and it should work.

-1

Before installing please run

sudo apt-get -f install

then install the forticlient package

sudo dpkg -i FortiClientFullVPNInstaller_6.4.0.0851.deb
-1

Before installing add your sources.list this repo;

deb http://ftp.br.debian.org/debian stable main contrib non-free

After then run this commands;

sudo apt-get update
sudo apt-get install libappindicator1
wget -O - https://repo.fortinet.com/repo/6.4/ubuntu/DEB-GPG-KEY | sudo apt-key add -

After add this repo on your sources.list;

deb https://repo.fortinet.com/repo/6.4/ubuntu/ /bionic multiverse

Finaly run this commands;

sudo apt-get update
sudo apt install forticlient
-1

In my case on Lubuntu 20.10, I found that libs libappindicator1 and libgconf-2-4 were missing. On the terminal, run these commands:

sudo apt-get update
sudo apt-get install libgconf-2-4
sudo apt-get install libappindicator1

Then...

sudo apt-get update
sudo dpkg -i forticlient_vpn_7.0.0.0018_amd64.deb

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .