How to get forticlient working in OSX El Capitan

Edited Answer

(Re)improved on just about everybody else's improved answer (@elmart, @user26312,myself). Edits should not be needed in the script:

#!/bin/bash
default_line=$(netstat -rn |grep default)
gateway=$(echo $default_line | awk '{print $2}')
interface=$(echo $default_line | awk '{print $6}')
echo $gateway
echo $interface

scutil <<EOF
d.init
get State:/Network/Service/forticlientsslvpn/IPv4
d.add InterfaceName ppp0
set State:/Network/Service/forticlientsslvpn/IPv4
EOF

route delete default
route delete -ifscope $interface default
route add -ifscope $interface default $gateway
route add -net 0.0.0.0 -interface $interface

Make the file you put this in, executable and execute (after connecting with the VPN) with sudo. Before the script does any changes, it looks at your current default route and therefore knows your current gateway and interface.

---

Old answer

Not a complete solution, you'll have to do the following two high-level things after each VPN connection setup:

1. We'll have to set the tunnel's interface to ppp0
2. Redo default routes (because 1. implicitly sets the wrong default gateway, split tunnel should still work correctly hereafter)

---

Create a file with the name scutil-forti for example

d.init
get State:/Network/Service/forticlientsslvpn/IPv4
d.add InterfaceName ppp0
set State:/Network/Service/forticlientsslvpn/IPv4

Redo gateway routes, so make another file, routes-forti, with (mind the lines with specific settings for your network):

sudo route delete default
sudo route delete  -ifscope en0 default # This line depends on your interface
sudo route add -ifscope en0 default 192.168.2.252  # This depends on your normal local gateway.
sudo route add -net 0.0.0.0 -interface en0

now, execute,

$ cat scutil-forti |sudo scutil ; bash routes-forti

I've reworked @hbogert's solution into a more manageable single script:

#!/bin/bash

scutil <<EOF
d.init
get State:/Network/Service/forticlientsslvpn/IPv4
d.add InterfaceName ppp0
set State:/Network/Service/forticlientsslvpn/IPv4
EOF

route delete default
route delete -ifscope en0 default
route add -ifscope en0 default 192.168.1.1
route add -net 0.0.0.0 -interface en0

That is assuming you're using en0 interface and 192.168.1.1 default gateway. If not, replace those with your corresponding values. If you don't know them, type route get www.google.com to get them. Then:

• Place that into a file (e.g. 'fix-vpn') somewhere in your path.
• Give it execute permissions (chmod u+x fix-vpn).
• Run it with sudo (sudo fix-vpn) just after connecting to vpn.

I've tried it and it works. As I said, this is just a rework of a previous solution. I just posted it as a separate answer because I didn't have space enough in a comment.

BTW, I also thought this could be included in a /etc/ppp/ip-up script so that it gets automatically executed when connecting. But for some reason, it doesn't work that way. If somebody can explain/improve on that, please do.

I was able to use an older version of Forticlient and confirmed that it works!

Here's the link to it on my dropbox:

https://www.dropbox.com/s/p43ssvp0gusmzeq/forticlientsslvpn_macosx_4.0.2297.dmg?dl=0