Forticlient VPN not working with hotspot

Understanding the hotspot challenge for FortiClient VPN

When you connect a device to a phone’s hotspot, your traffic is routed through the carrier’s network and then NAT’d at the hotspot or carrier edge. This can create:

• NAT traversal problems for VPN protocols that don’t handle double NAT gracefully
• MTU or fragmentation issues that break the VPN handshake
• Intermittent drops when the hotspot device switches networks or re-establishes sessions
• Additional latency or jitter that destabilizes the VPN tunnel during login

FortiClient VPN supports multiple transport options (SSL VPN, IPsec, etc.), but not all configurations tolerate hotspot conditions equally. The following sections outline practical steps to diagnose and fix common hotspots’ VPN issues.

Basic connectivity checks before tweaking FortiClient

Before diving into FortiClient settings, confirm the underlying network is reliable enough for a VPN handshake.

• Test internet access on the device via the hotspot: open a web page or run a speed test.
• Try a different device on the same hotspot to see if the issue is device-specific.
• Check for carrier or hotspot firmware alerts that could block VPN ports.
• Ensure the FortiClient app is up to date. Outdated clients struggle with newer VPN gateways.

If basic connectivity is failing, address that first. VPNs rely on a stable data channel. Without it, no amount of tunneling configuration will help.

FortiClient settings commonly affected by hotspots

Several FortiClient settings can influence whether a VPN session can complete over a hotspot. Adjust these with care, and test after each change. Why your VPN keeps turning on by itself

SSL VPN vs IPsec VPN

• SSL VPN (aka FortiSSL) uses TLS over TCP/UDP and tends to be more robust on lossy networks.
• IPsec (IKEv2/L2TP) can be more sensitive to NAT and MTU issues in mobile networks.

If your gateway supports both, try SSL VPN first. If you must use IPsec, be prepared to adjust MTU.

Transport protocol and port considerations

• SSL VPN typically uses port 443 (and sometimes 8443). If the hotspot blocks unusual ports, staying on 443 helps.
• IPsec might require UDP 4500 for NAT-T. Some hotspots don’t forward or reliably handle IPsec NAT-T traffic.

In FortiClient:

• Open VPN settings and choose SSL VPN if available.
• If on IPsec, ensure NAT-T is enabled on both client and gateway sides (if you control the gateway).

MTU and fragmentation

High packet loss or MTU mismatches cause VPN handshakes to stall or fail.

• Typical MTU for VPN over HTTPS is 1400–1500 bytes, but NAT’d hotspots can require smaller values.
• Adjust MTU: in Windows, you can set MTU for the FortiClient interface via netsh. On Android/iOS, you may need to adjust via hotspot settings or router.

Testing approach:

• Start with MTU 1400 and adjust downward in small steps (1380, 1360, etc.) until the VPN connects reliably.
• Avoid setting MTU too low, which degrades performance.

DNS and split tunneling

• If DNS isn’t resolving the VPN gateway while on hotspot, the tunnel can establish but traffic won’t route correctly.
• Check FortiClient DNS settings or set an external DNS (e.g., 8.8.8.8, 1.1.1.1) to ensure resolution during VPN use.
• Consider enabling or disabling split tunneling per your security policy. Some hotspots assume all traffic should go through the gateway. Enabling full tunnel can reduce leakage risks and connectivity issues.

Common hotspot-specific fixes you can try

The following fixes address typical hotspots’ quirks. Try them in a pragmatic order: least invasive first, then escalate. How to use a VPN on your Xbox using Microsoft Edge

• Disable Maximize Compatibility (iPhone hotspot) Some devices offer a “Maximize Compatibility” option that increases compatibility for older devices but can complicate VPN handshakes. Disable it and test again.

• On iPhone: Settings > Personal Hotspot > Disable "Maximize Compatibility" if present.

• Re-test FortiClient after toggling.

• Switch between 4G and 5G (or different bands) If your hotspot supports multiple bands, switching bands may improve stability. Some VPN gateways struggle on crowded spectra, causing occasional packet loss that disrupts the handshake.

• Toggle APN settings (where possible) Some carriers offer APN profiles that affect VPN traffic shaping. If you know how to safely adjust APN settings or test with a different SIM, this can help isolate carrier-level blocking or throttling. How to use Microsoft Edge's built-in secure network VPN feature

• Reboot devices Simple, but powerful. Reboot the hotspot device, your tethered device, and if needed, the FortiClient app. A fresh session can clear stuck handshakes.

• Use a different VPN gateway or profile If you control the gateway, try a test gateway or a different FortiGate cluster. Some gateways handle mobile NAT traversal better than others.

• Disable firewall features on the hotspot (if configurable) Some hotspots have firewall settings that aggressively drop VPN traffic. If you can temporarily loosen firewall rules for VPN ports (443, 4500, etc.), test again.

• Check for software conflicts Other VPN or security apps running on the same device can interfere with FortiClient, especially on mobile devices where resources are limited.

A practical troubleshooting checklist

To make the process concrete, use this checklist when you’re on a hotspot. Download f5 big-IP Edge VPN client for Windows 10 and 11

• Confirm basic internet access through the hotspot.
• Ensure FortiClient is up to date.
• Test SSL VPN first. If not available, test IPsec with NAT-T enabled.
• Reduce MTU to 1400, then 1380 if needed. Document results.
• Change DNS to a reliable public DNS and verify gateway reachability.
• Disable hotspot “Maximize Compatibility” if present.
• Reboot devices. Re-test after each change.
• Try with a different device as the FortiClient client to rule out device-specific issues.
• If possible, test on a home Wi-Fi or a different mobile network (another SIM or hotspot) to compare behavior.

A quick comparison: SSL VPN vs IPsec over hotspot

Real-world patterns and what to expect

Users frequently report FortiClient VPN “stuck at 98%” during login when connected to a mobile hotspot. This symptom often points to a handshake getting dropped due to NAT mishandling, MTU fragmentation, or blocked UDP ports on the carrier network. Switching to SSL VPN, lowering MTU, and ensuring DNS resolution within the tunnel are common paths to success. If you control the FortiGate gateway, you can also adjust the gateway’s NAT and TLS settings to be more forgiving on mobile networks.

Other users report that after disabling Maximize Compatibility on the hotspot or moving to a different carrier, the VPN connects more reliably. In environments where the hotspot must be used for work, building a small local test lab with a few gateway configurations can save time by letting you reproduce the issue with repeatable settings.

When to escalate or seek help

If you’ve tried the above steps and FortiClient VPN still doesn’t work with hotspot, consider: Why your iPhone VPN keeps connecting

• Checking Fortinet’s official product notes for your FortiClient version and FortiGate firmware for hotspot-related caveats.
• Reaching out to your IT department or Fortinet support with exact logs, including FortiClient logs, gateway version, MTU settings, and hotspot model.
• Trying a different network as a temporary workaround (e.g., a reputable public Wi-Fi with a known VPN-friendly firewall) while you resolve hotspot compatibility.

Collecting precise logs can help the support team pinpoint whether the issue lies in NAT traversal, MTU fragmentation, or a firewall rule on the gateway. If you can reproduce the issue with a wired connection, perform the same steps to separate device/network-specific causes.

Final recommendation

FortiClient VPN not working with hotspot is a solvable problem, but it often requires targeted tweaks rather than sweeping changes. Start with SSL VPN if your gateway supports it, adjust MTU downward to around 1400 and test, ensure DNS resolution inside the tunnel, and disable hotspot features that impede VPN handshakes. If you’re still stuck after these steps, methodically gather logs, compare results across different networks, and consult Fortinet support with your test plan. The combination of protocol choice (SSL VPN first), MTU tuning, and stable DNS usually yields the best outcomes for FortiClient VPN over a mobile hotspot.