Troubleshooting Tip: SSL VPN connection fails when ssl.root interface is added to a zone

When ssl.root interface is added to a zone, SSL VPN connections fail.

config system zone
    edit "VPN"
        set interface "VPN1" "ssl.root"
    next

SSL VPN debug logs may not display any output at the time of the issue. Additionally, the SSL VPN daemon (sslvpnd) process may be failing to start.

diagnose debug app sslvpnd -1 <----- Debugs do not print any output.
diagnose debug enable
diagnose sys process pidof sslvpnd <----- Process ID of sslvpnd daemon is not listed.

This issue has been resolved in v7.6.3.

Note:

Starting from v7.6.3, SSL VPN tunnel mode is no longer supported. This applies to all FortiGate models.

Workaround:

Remove the ssl.root from the zone.

Related article:

Technical Tip: Upcoming changes on SSL VPN modes starting from v7.6.3