Skip to main content
asomnet-sysadm
asomnet-sysadm
Explorer
January 27, 2025
Question

Automatic firmware update, clients now say Credential or ssl vpn configuration is wrong (-7200)

  • January 27, 2025
  • 5 replies
  • 1585 views

Hi,

 

Our FG200 firewall cluster auto updated last night, and now we have several win11 failing with the following error : 
Credential or ssl vpn configuration is wrong (-7200)

 

Checking "Use external browser as user-agent for saml user authentication" solved the problem. Any ideas why this might have happened and if there's an easy fix? We don't know how many clients are affected yet and it would be much better if we can change something on the firewall side to resolve the problem, instead of having to change settings on all win11 clients.

5 replies

AEK
SuperUser
AEK
SuperUser
January 27, 2025

Hi

Is it SSL VPN?

Is VPN user authenticated with RADIUS?

AEK
JL1
JL1
New Member
January 27, 2025

Greetings, 
Assuming the referenced upgrade was v7.0.16 to 7.0.17. and Forticlient 7.4.x (If not, this can be disregarded)
There was a change note in 7.0.17:

1101837

Insufficient Session Expiration in SSLVPN using SAML authentication.
This seems to have had some negative effect.  
I'd opened a support ticket and they essentially told me that 7.0.x was EOES and could not guarantee a solution.  Ended up pushing to 7.2.10 and this issue was no longer observed. 
There's another thread here: https://community.fortinet.com/t5/Support-Forum/7-0-17-breaking-SAML/m-p/371425#M261521

    dingjerry_FTNT
    Staff
    dingjerry_FTNT
    Staff
    January 27, 2025

    Hi @asomnet-sysadm ,

     

    It's better to provide the firmware version info.

    MZBZ
    Staff
    MZBZ
    Staff
    February 1, 2025

    You should plan upgrading to FortiOS 7.4.7 and most importantly migrate to IPSec IKEv2 VPN...

    asomnet-sysadm
    asomnet-sysadmAuthor
    Explorer
    February 3, 2025

    Sorry, I forgot to mention the software version. We upgraded from 7.0.14 to 7.4.6 and all was fine, but for some reason auto updates were automatically enabled so one night the firewall upgraded from 7.4.6 to 7.4.7 and it was after this auto update the clients started failing. Checking "Use external browser as user-agent for saml user authentication" it started working again. No idea what happened though. Upgrading the client to the latest version wouldn't help either.

      Terms & ConditionsAccessibility statement