The "FortiClient VPN" is needed. You can pick the suitable version for your MacOS version below:

FortiClient installer for macOS 13 Ventura, macOS 12 Monterey, macOS 11 Big Sur and macOS 10.15 Catalina

FortiClient 7.0.7

FortiClient installer for macOS 10.13 High Sierra and 10.14 Mojave


FortiClient installer for older macOS versions (10.09, 10.10, 10.11, 10.12)

FortiClient_6.0.2.dmg Note: Please pick the tab "remote access" to establish/configure the vpn connection. You can ignore the "Compliance & Telemetry" tab.


Download and execute the installer to get the following options:

Note: You may need to uninstall the old version if you want to upgrade an already installed FortiClient VPN to version 7.0.7. To uninstall old FortiClient VPN you can pick the "Uninstall" option from the FortiClient VPN installer (see picture above).

Click "Install" to start the installation process. There will be a short description of FortiClient.

Click "Continue".

The software licence agreement is shown, click on "Continue" and "Agree" when the pop up appears.

When clicking on "Install" you have to enter the login information of an user with admin privileges:

Fill out the infos and click on "Install Software" to start the installation. You may be shown a pop up "fortiTray Would Like to Add VPN Configurations". Click on "Allow" to grant the needed rights.

When successfully finished you will be shown

Installation is finished and FortiClient is now running, to open it you can click the icon in the taskbar and "Open FortiClient Console".

You are shown an information stating there is no (technical) support from Fortinet. If you need support ask our Service Desk Staff (smile)

Tick the box next to the text and click "I accept".

Also make sure the needed permissions are granted:

Open "System Settings", click on "Privacy & Security" then click "Full Disk Access". Make sure the boxes for "fctservctl2" and FortiClient are checked:


Click on "Configure VPN"

The Client is able to establish different types of VPN connections so make sure "SSL-VPN" is selected. The configuration for our standard VPN connection should look something like this:

VPNSSL-VPNType of VPN connection. Should be "SSL-VPN"
Connection NameSSL-VPN FRA-UAS pub-allCan be freely selected
Can be freely selected

Gateway address. The "Realm" (VPN tunnel name) follows the slash /

In most cases the realm is pub-all but it may differ when using a different tunnel. The port may also be customized but in this case just leave it at 443 (default). "Enable Single Sign On (SSO) for VPN Tunnel" can be ignored (default).

Client CertificateNoneCertificate used for authentication. In this case no certificate is used (default)
AuthenticationPrompt on login/save loginYou may choose to save the login information.

Click on "Save" to save the configuration. Subsequently the connection can be established.

At the Startpage you will find the connection. Enter the login information for your CIT-Account and click on "Connect". When successfully connected you will be shown something like this: