Some more info gathered this afternoon.
It seems that network-manager-fortisslvpn also makes a mess with the routing
table after the connection has been established.
I could easily get a working VPN by adding
ipcp-accept-remote
to /etc/ppp/options and manually launching openfortivpn; such setting also
allowed NetworkManager to accept the IP address supplied by the counterpart (it
was the default until ppp v2.4.9), but in this case the connection didn't work
until I deleted a rule in the routing table which routed the IP address of the
remote gateway through the ppp0 interface (!).
A duplicate default route through the main physical network interface was
created too and the spawned pppd process didn't exit after the connection has
been terminated and had to be killed manually: none of these issues happened
when openfortivpn was launched manually.
Thanks
