u/Fun_Efficiency6189

I’m running FortiClient EMS 7.4.7 managing 16 production servers. All are configured with IPsec VPNs, Always-Up, and Auto-Connect enabled.

Occasionally, a tunnel drops and stays down indefinitely. The strange part is that the FortiClient service is still running and the endpoint is "Synchronized" with EMS, but it makes zero attempts to reconnect on its own.

Observations:

• No auto-recovery: Even though Always-Up is active, the FortiGate logs show no incoming Phase 1 attempts once the tunnel is down.
• If I log into the server and simply click the "Connect" button in the FortiClient Console, the VPN establishes immediately. No service restart or reboot is required.
• EMS Sync doesn't help: Pushing a profile update from EMS shows as "Success" on the console, but it doesn't trigger the client to actually start the connection.

It seems like the "Auto-Connect" logic hits a specific error state and just stops trying until a user manually interacts with the GUI. Has anyone found a way to make the Auto-Connect more persistent or experienced this "silent failure" of the Always-Up flag?

Hi everyone,

I’m running FortiClient EMS 7.4.7 managing 16 production servers. All are configured with IPsec VPNs, Always-Up, and Auto-Connect enabled.

Occasionally, a tunnel drops and stays down indefinitely. The strange part is that the FortiClient service is still running and the endpoint is "Synchronized" with EMS, but it makes zero attempts to reconnect on its own.

Observations:

• No auto-recovery: Even though Always-Up is active, the FortiGate logs show no incoming Phase 1 attempts once the tunnel is down.
• If I log into the server and simply click the "Connect" button in the FortiClient Console, the VPN establishes immediately. No service restart or reboot is required.
• EMS Sync doesn't help: Pushing a profile update from EMS shows as "Success" on the console, but it doesn't trigger the client to actually start the connection.

It seems like the "Auto-Connect" logic hits a specific error state and just stops trying until a user manually interacts with the GUI. Has anyone found a way to make the Auto-Connect more persistent or experienced this "silent failure" of the Always-Up flag?

Thanks!