Troubleshooting Tip: 'Command fail. Return code -61 ' error while configuring source address under authentication rule for SSL VPN

Description

This article describes a scenario where the error 'Command fail. Return code -61' is observed while attempting to configure a source address under the authentication rule for SSL VPN.

Scope

FortiGate.

Solution

A source address can be configured for an SSL VPN portal; however, this setting is available only through the CLI. Before configuring the source address under the SSL VPN portal, the corresponding address object must first be created. Address objects can be created from the GUI.

If a source address is configured without first defining the source interface under config authentication-rule , the following error will be observed in the CLI:

config vpn ssl settings
    config authentication-rule
        edit 1
            set groups "SSL_VPN"
            set portal "tunnel-access"
            set source-address "Address"
command parse error before 'source-address'
Command fail. Return code -61

To configure a source address successfully, a source interface must first be defined under the authentication rule settings in the CLI. After defining the source interface, the source-address option becomes available for configuration.

config vpn ssl settings
    config authentication-rule
        edit 1
            set groups "SSL_VPN"
            set portal "tunnel-access"
            set source-interface port3
            set source-address "Address"
        next
    end
end

The source-interface must be the interface on which the SSL VPN service is enabled.