Technical Tip: Enable DTLS in an AWS environment

Consider the following example scenario:

A customer must enable DTLS in their SSL VPN connection. DTLS is already enabled on the FortiGate side, but packet capture and debug logs show that traffic is passing over TLS. DTLS is already enabled on the FortiGate side.

Below is the packet capture on the test machine. As shown, only 'Client Hello' packets are observed on the test machine.

However, on the FortiGate side, no DTLS packet is received:

To resolve this, the custom UDP port should be configured on the AWS side.

After making the changes, two-way DTLS traffic can be observed:

• Test machine:
  
  

• FortiGate:

See Enable DTLS on FortiGate - FortiGate documentation for a general guide on how to enable DTLS on FortiGate.