Description
This document will explain how to maintain Internet access during IPSec SA negotiation for Dialup FortiClient VPN. Maintaining this access may be necessary for some scenarios such as for two-factor email authentication.
Scope
FortiClient
Solution
The FortiClient by default will block Internet traffic during the IPSec SA negotiation. If you are using email two-factor authentication, you will be unable to get the email on the connecting computer, you would need another device in order to receive the email.
In order to allow Internet traffic to pass during the IPSec SA negotiation, (allowing the connecting computer to get the email) you will need to change the value of the <implied_SPDO> tag in the FortiClient's xml file from 0 to 1.
Change the output to:
<implied_SPDO>1</implied_SPDO>
The tag is located under:
<ipsecvpn>
<connections>
<connection>
<ike_settings>
<implied_SPDO>
***This option is available in FortiClient 5.2 and later.***
