Skip to main content
thiagojdb
thiagojdb
New Member
June 14, 2024
Solved

Cannot connect to network: Create VPN network interface failed

  • June 14, 2024
  • 7 replies
  • 5195 views

OS: Linux
Kernel: 6.9.3

FortiClient VPN Version: 7.4.0.1636

I have been connecting to this network for months, this morning when trying to connect I had this on my console output

 

Create VPN network interface failed

Now the usual way of connection just does not work. Here are my log outputs:


sslvpn.log

 

20240614 14:13:09.997 TZ=+0100 [sslvpn:INFO] main:1817 Init 20240614 14:13:09.000 TZ=+0100 [sslvpn:INFO] main:622 Load profile: eicon 20240614 14:13:09.002 TZ=+0100 [sslvpn:DEBG] main:631 Inherit local DNS: No 20240614 14:13:09.002 TZ=+0100 [sslvpn:DEBG] main:644 DNS service resetting interval: 0 20240614 14:13:09.002 TZ=+0100 [sslvpn:INFO] main:329 Get DBUS session bus address 20240614 14:13:10.004 TZ=+0100 [sslvpn:DEBG] main:333 Failed to find DBUS session bus address in dbus-daemon, try to find in dbus-broker 20240614 14:13:10.005 TZ=+0100 [sslvpn:DEBG] main:393 get passwd: true, get cert passwd: false, get user input: false 20240614 14:13:10.018 TZ=+0100 [sslvpn:INFO] main:329 Get DBUS session bus address 20240614 14:13:10.020 TZ=+0100 [sslvpn:DEBG] main:333 Failed to find DBUS session bus address in dbus-daemon, try to find in dbus-broker 20240614 14:13:10.021 TZ=+0100 [sslvpn:INFO] main:1288 Load profile: eicon 20240614 14:13:10.022 TZ=+0100 [sslvpn:DEBG] main:1676 FCT UID: 4EDEF716958543398A8C4A27C64F422D 20240614 14:13:10.023 TZ=+0100 [sslvpn:DEBG] main:1691 EMS not registed 20240614 14:13:10.023 TZ=+0100 [sslvpn:DEBG] main:1704 Public IP is not set 20240614 14:13:10.023 TZ=+0100 [sslvpn:INFO] main:1481 State: Connecting 20240614 14:13:10.034 TZ=+0100 [sslvpn:DEBG] vpn_connection:1506 Server URL: https://MY_NETWORK_HOSTNAME 20240614 14:13:10.047 TZ=+0100 [sslvpn:INFO] main:1481 State: Logging in 20240614 14:13:10.047 TZ=+0100 [sslvpn:INFO] vpn_connection:1944 /remote/info 20240614 14:13:14.391 TZ=+0100 [sslvpn:DEBG] vpn_connection:406 https server 'MY_NETWORK_HOSTNAME' has this certificate, which looks good to me: 20240614 14:13:14.839 TZ=+0100 [sslvpn:DEBG] vpn_connection:599 http connection closed. 20240614 14:13:14.839 TZ=+0100 [sslvpn:DEBG] vpn_connection:478 Response line: 200 OK 20240614 14:13:14.839 TZ=+0100 [sslvpn:INFO] sslvpn:92 ApiEncMethod: 0 20240614 14:13:14.839 TZ=+0100 [sslvpn:INFO] sslvpn:93 ApiRemoteAuthTimeout: 30 20240614 14:13:14.839 TZ=+0100 [sslvpn:INFO] sslvpn:94 ApiServerSalt: 1c941201 20240614 14:13:14.839 TZ=+0100 [sslvpn:INFO] sslvpn:95 flag: 15583 20240614 14:13:14.839 TZ=+0100 [sslvpn:INFO] vpn_connection:1944 /remote/login 20240614 14:13:18.690 TZ=+0100 [sslvpn:DEBG] vpn_connection:406 https server 'MY_NETWORK_HOSTNAME' has this certificate, which looks good to me: 20240614 14:13:19.198 TZ=+0100 [sslvpn:DEBG] vpn_connection:599 http connection closed. 20240614 14:13:19.200 TZ=+0100 [sslvpn:DEBG] vpn_connection:478 Response line: 200 OK 20240614 14:13:19.200 TZ=+0100 [sslvpn:INFO] vpn_connection:1944 /remote/logincheck 20240614 14:13:22.887 TZ=+0100 [sslvpn:DEBG] vpn_connection:406 https server 'MY_NETWORK_HOSTNAME' has this certificate, which looks good to me: 20240614 14:13:23.406 TZ=+0100 [sslvpn:DEBG] vpn_connection:599 http connection closed. 20240614 14:13:23.406 TZ=+0100 [sslvpn:DEBG] vpn_connection:478 Response line: 200 OK 20240614 14:13:23.406 TZ=+0100 [sslvpn:INFO] sslvpn:234 Authentication passed. 20240614 14:13:23.406 TZ=+0100 [sslvpn:INFO] vpn_connection:1944 /remote/fortisslvpn 20240614 14:13:27.189 TZ=+0100 [sslvpn:DEBG] vpn_connection:406 https server 'MY_NETWORK_HOSTNAME' has this certificate, which looks good to me: 20240614 14:13:27.800 TZ=+0100 [sslvpn:DEBG] vpn_connection:599 http connection closed. 20240614 14:13:27.800 TZ=+0100 [sslvpn:DEBG] vpn_connection:478 Response line: 200 OK 20240614 14:13:27.800 TZ=+0100 [sslvpn:INFO] vpn_connection:1944 /remote/fortisslvpn_xml 20240614 14:13:31.694 TZ=+0100 [sslvpn:DEBG] vpn_connection:406 https server 'MY_NETWORK_HOSTNAME' has this certificate, which looks good to me: 20240614 14:13:32.819 TZ=+0100 [sslvpn:DEBG] vpn_connection:599 http connection closed. 20240614 14:13:32.820 TZ=+0100 [sslvpn:DEBG] vpn_connection:478 Response line: 200 OK 20240614 14:13:32.820 TZ=+0100 [sslvpn:DEBG] server_response_parser:114 DTLS config heartbeat interval: 3 20240614 14:13:32.820 TZ=+0100 [sslvpn:DEBG] server_response_parser:115 DTLS config heartbeat fail count: 3 20240614 14:13:32.820 TZ=+0100 [sslvpn:DEBG] server_response_parser:116 DTLS config heartbeat idle timeout: 3 20240614 14:13:32.820 TZ=+0100 [sslvpn:DEBG] server_response_parser:117 DTLS config client hello timeout: 10 20240614 14:13:32.820 TZ=+0100 [sslvpn:INFO] vpn_connection:1944 /remote/portal 20240614 14:13:36.611 TZ=+0100 [sslvpn:DEBG] vpn_connection:406 https server 'MY_NETWORK_HOSTNAME' has this certificate, which looks good to me: 20240614 14:13:37.219 TZ=+0100 [sslvpn:DEBG] vpn_connection:599 http connection closed. 20240614 14:13:37.220 TZ=+0100 [sslvpn:DEBG] vpn_connection:478 Response line: 200 OK 20240614 14:13:37.220 TZ=+0100 [sslvpn:INFO] sslvpn:463 /remote/portal username extracted thiago.sousa 20240614 14:13:37.220 TZ=+0100 [sslvpn:DEBG] vpn_connection:1359 Login process end on status: 0 20240614 14:13:37.220 TZ=+0100 [sslvpn:INFO] sslvpn:824 Login successful 20240614 14:13:37.254 TZ=+0100 [sslvpn:INFO] main:1481 State: Configuring tunnel 20240614 14:13:37.259 TZ=+0100 [sslvpn:EROR] vif:32 Failed open tun device 20240614 14:13:37.259 TZ=+0100 [sslvpn:EROR] vpn_connection:1627 Create VPN network interface failed 20240614 14:13:37.265 TZ=+0100 [sslvpn:DEBG] dns:73 Restore DNS config 20240614 14:13:37.265 TZ=+0100 [sslvpn:DEBG] dns:77 No DNS backup file was found. Skip. 20240614 14:13:37.265 TZ=+0100 [sslvpn:DEBG] mtu:116 Restore MTU. 20240614 14:13:37.265 TZ=+0100 [sslvpn:DEBG] mtu:120 No MTU backup file was found. Skip. 20240614 14:13:37.265 TZ=+0100 [sslvpn:DEBG] route:160 clean up route... 20240614 14:13:37.265 TZ=+0100 [sslvpn:DEBG] route:164 Cleanup file not found 20240614 14:13:37.265 TZ=+0100 [sslvpn:DEBG] main:1911 exception: Create VPN network interface failed 20240614 14:13:37.286 TZ=+0100 [sslvpn:INFO] main:1817 Init 20240614 14:13:37.286 TZ=+0100 [sslvpn:INFO] main:1829 VPN is running in restore DNS mode 20240614 14:13:37.291 TZ=+0100 [sslvpn:DEBG] dns:73 Restore DNS config 20240614 14:13:37.291 TZ=+0100 [sslvpn:DEBG] dns:77 No DNS backup file was found. Skip. 20240614 14:13:37.291 TZ=+0100 [sslvpn:DEBG] mtu:116 Restore MTU. 20240614 14:13:37.291 TZ=+0100 [sslvpn:DEBG] mtu:120 No MTU backup file was found. Skip.

 


Any ideas on what might be misconfigured?

 

 

Best answer by thiagojdb

@ndumaj
I do not know why, but this Monday morning when I tried connecting it just connected. Even though it does not work through the CLI anymore I managed to connect through the GUI app.
I did not change anything on my system since the post, but the error stopped so I'm closing the post.

Oh, btw, what is this diag command you mentioned. In case this happens again i can expand the logs.
The only executables I got from the install are forticlient and fortivpn(which apparently is just a shortcut for running forticlient vpn).


Thank you for your time.

7 replies

hbac
Staff & Editor
hbac
Staff & Editor
June 14, 2024

Hi @thiagojdb,

 

Have you tried different FortiClient versions?

 

Regards,

thiagojdb
thiagojdbAuthor
New Member
June 17, 2024

@hbac 
I had an older version installed, do not remember which one. The error started happening, then I removed the version I had and downloaded the latest one available. The error persisted.

I do not know why, but this Monday morning when I tried connecting it just connected. Even though it does not work through the CLI anymore I managed to connect through the GUI app.
I did not change anything on my system since the post, but the error stopped so I'm closing the post.

ndumaj
Staff
ndumaj
Staff
June 15, 2024

Hello @thiagojdb,

 

It looks like the client fails setting up the tunnel:

20240614 14:13:37.259 TZ=+0100 [sslvpn:EROR] vif:32 Failed open tun device 20240614 14:13:37.259 TZ=+0100 [sslvpn:EROR] vpn_connection:1627 Create VPN network interface failed

 As hbac you can try with several forticlient version if it will work, otheriwse enable the debug on FGT:

diag debug console timestamp enable

diag debug app fnbamd -1

diag debug app sslvpn -1

diag debug enable

Additionally, check the timeout settings:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Explanation-of-auth-timeout-types-for-Firewall/ta-p/189423

https://community.fortinet.com/t5/FortiGate/Technical-Tip-auth-timeout-setting-for-SSL-VPN/ta-p/220586

BR




 

thiagojdb
thiagojdbAuthorAnswer
New Member
June 17, 2024

@ndumaj
I do not know why, but this Monday morning when I tried connecting it just connected. Even though it does not work through the CLI anymore I managed to connect through the GUI app.
I did not change anything on my system since the post, but the error stopped so I'm closing the post.

Oh, btw, what is this diag command you mentioned. In case this happens again i can expand the logs.
The only executables I got from the install are forticlient and fortivpn(which apparently is just a shortcut for running forticlient vpn).


Thank you for your time.

    ndumaj
    Staff
    ndumaj
    Staff
    June 17, 2024

    Hi @thiagojdb 

    Nice to hear that it worked,

    The diag will check the authentication process "FNBAM Daemon" and SSLVPN.

    From the guide, I found only this:
    https://docs.fortinet.com/document/forticlient/7.4.0/linux-release-notes/580078

    To open the FortiClient (Linux) GUI:
    1. Do one of the following:
      1. In the terminal, run the forticlient command.
      2. Open Applications and search for forticlient.

        BR

    jota0222
    jota0222
    New Member
    November 19, 2025

    For future reference to others facing similar issue:

    I had this same problem except the error in logs said 

    Error: argument 'reload' not understood. Try passing --help instead.

    So, I found it was an issue with nmcli in Linux Debian. So I renamed /etc/bin/nmcli to /etc/bin/nmcli-bin and it worked. I suppose that if it doesn't find the nmcli it uses a fallback method.
     

      ndumaj
      Staff
      ndumaj
      Staff
      November 19, 2025

      Hello @jota0222 

      Great, thanks for sharing.

      BR

      Terms & ConditionsAccessibility statement
      Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
      Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!