Skip to main content
Jobert
Jobert
New Member
October 28, 2020
Question

FortiClient 'Connection Error!' – SSLVPN Suddenly stopped working for all users

  • October 28, 2020
  • 3 replies
  • 14673 views

Hi all, Our SSLVPN was working fine for a few months but has suddenly stopped working. I've tried performing all updates and restarting the Fortigate 50E but still have the same issue across all users. CLI debug below: Any ideas? 

FGT50E3U17044011 # [222:root:4c]allocSSLConn:282 sconn 0x55d52900 (0:root)
[222:root:4c]SSL state:before SSL initialization (192.168.10.31)
[222:root:4c]SSL state:before SSL initialization (192.168.10.31)
[222:root:4c]got SNI server name: 118.xxx.xxx.xxx realm (null)
[222:root:4c]client cert requirement: no
[222:root:4c]SSL state:SSLv3/TLS read client hello (192.168.10.31)
[222:root:4c]SSL state:SSLv3/TLS write server hello (192.168.10.31)
[222:root:4c]SSL state:SSLv3/TLS write certificate (192.168.10.31)
[222:root:4c]SSL state:SSLv3/TLS write key exchange (192.168.10.31)
[222:root:4c]SSL state:SSLv3/TLS write server done (192.168.10.31)
[222:root:4c]SSL state:SSLv3/TLS write server done:system lib(192.168.10.31)
[222:root:4c]SSL state:SSLv3/TLS write server done (192.168.10.31)
[222:root:4c]SSL state:SSLv3/TLS read client key exchange (192.168.10.31)
[222:root:4c]SSL state:SSLv3/TLS read change cipher spec (192.168.10.31)
[222:root:4c]SSL state:SSLv3/TLS read finished (192.168.10.31)
[222:root:4c]SSL state:SSLv3/TLS write change cipher spec (192.168.10.31)
[222:root:4c]SSL state:SSLv3/TLS write finished (192.168.10.31)
[222:root:4c]SSL state:SSL negotiation finished successfully (192.168.10.31)
[222:root:4c]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
[222:root:4c]req: /remote/info
[222:root:4c]sslConnGotoNextState:302 error (last state: 1, closeOp: 0)
[222:root:4c]Destroy sconn 0x55d52900, connSize=0. (root)
[222:root:4d]allocSSLConn:282 sconn 0x55d52900 (0:root)
[222:root:4d]SSL state:before SSL initialization (192.168.10.31)
[222:root:4d]SSL state:before SSL initialization (192.168.10.31)
[222:root:4d]got SNI server name: 118.xxx.xxx.xxx realm (null)
[222:root:4d]client cert requirement: no
[222:root:4d]SSL state:SSLv3/TLS read client hello (192.168.10.31)
[222:root:4d]SSL state:SSLv3/TLS write server hello (192.168.10.31)
[222:root:4d]SSL state:SSLv3/TLS write certificate (192.168.10.31)
[222:root:4d]SSL state:SSLv3/TLS write key exchange (192.168.10.31)
[222:root:4d]SSL state:SSLv3/TLS write server done (192.168.10.31)
[222:root:4d]SSL state:SSLv3/TLS write server done:system lib(192.168.10.31)
[222:root:4d]SSL state:SSLv3/TLS write server done (192.168.10.31)
[222:root:4d]SSL state:SSLv3/TLS read client key exchange (192.168.10.31)
[222:root:4d]SSL state:SSLv3/TLS read change cipher spec (192.168.10.31)
[222:root:4d]SSL state:SSLv3/TLS read finished (192.168.10.31)
[222:root:4d]SSL state:SSLv3/TLS write change cipher spec (192.168.10.31)
[222:root:4d]SSL state:SSLv3/TLS write finished (192.168.10.31)
[222:root:4d]SSL state:SSL negotiation finished successfully (192.168.10.31)
[222:root:4d]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
[222:root:4d]req: /remote/login
[222:root:4d]rmt_web_auth_info_parser_common:440 no session id in auth info
[222:root:4d]rmt_web_get_access_cache:760 invalid cache, ret=4103
[222:root:4d]sslConnGotoNextState:302 error (last state: 1, closeOp: 0)
[222:root:4d]Destroy sconn 0x55d52900, connSize=0. (root)
[222:root:4e]allocSSLConn:282 sconn 0x55d52900 (0:root)
[222:root:4e]SSL state:before SSL initialization (192.168.10.31)
[222:root:4e]SSL state:before SSL initialization (192.168.10.31)
[222:root:4e]got SNI server name: 118.xxx.xxx.xxx realm (null)
[222:root:4e]client cert requirement: no
[222:root:4e]SSL state:SSLv3/TLS read client hello (192.168.10.31)
[222:root:4e]SSL state:SSLv3/TLS write server hello (192.168.10.31)
[222:root:4e]SSL state:SSLv3/TLS write certificate (192.168.10.31)
[222:root:4e]SSL state:SSLv3/TLS write key exchange (192.168.10.31)
[222:root:4e]SSL state:SSLv3/TLS write server done (192.168.10.31)
[222:root:4e]SSL state:SSLv3/TLS write server done:system lib(192.168.10.31)
[222:root:4e]SSL state:SSLv3/TLS write server done (192.168.10.31)
[222:root:4e]SSL state:SSLv3/TLS read client key exchange (192.168.10.31)
[222:root:4e]SSL state:SSLv3/TLS read change cipher spec (192.168.10.31)
[222:root:4e]SSL state:SSLv3/TLS read finished (192.168.10.31)
[222:root:4e]SSL state:SSLv3/TLS write change cipher spec (192.168.10.31)
[222:root:4e]SSL state:SSLv3/TLS write finished (192.168.10.31)
[222:root:4e]SSL state:SSL negotiation finished successfully (192.168.10.31)
[222:root:4e]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
[222:root:4e]req: /remote/logincheck
[222:root:4e]rmt_web_auth_info_parser_common:440 no session id in auth info
[222:root:4e]rmt_web_access_check:686 access failed, uri=[/remote/logincheck],ret=4103,
[222:root:4e]rmt_logincheck_cb_handler:917 user 'editor' has a matched local entry.
[222:root:4e]sslvpn_auth_check_usrgroup:1874 forming user/group list from policy.
[222:root:4e]sslvpn_auth_check_usrgroup:1916 got user (0) group (1:0).
[222:root:4e]sslvpn_validate_user_group_list:1479 validating with SSL VPN authentication rules (0), realm ().
[222:root:4e]sslvpn_validate_user_group_list:1802 got user (0), group (1:0).
[222:root:4e]two factor check for editor: off
[222:root:4e]sslvpn_authenticate_user:169 authenticate user: [editor]
[222:root:4e]sslvpn_authenticate_user:176 create fam state
[222:root:4e][fam_auth_send_req_internal:408] Groups sent to FNBAM:
[222:root:4e]group_desc[0].grpname = sslvpngroup 
[222:root:4e][fam_auth_send_req_internal:419] FNBAM opt = 0X420
[222:root:4e]fam_auth_send_req_internal:483 fnbam_auth return: 0
[222:root:4e][fam_auth_send_req_internal:507] Authenticated groups by FNBAM:
[222:root:4e]auth_rsp_data.grp_list[0] = sslvpngroup 
[222:root:4e][fam_auth_send_req_internal:583] The user editor is authenticated.
[222:root:4e]fam_do_cb:506 fnbamd return auth success.
[222:root:4e]SSL VPN login matched rule (0).
[222:root:4e]rmt_web_session_create:730 create web session, idx[0]
[222:root:4e]login_succeeded:399 redirect to hostcheck
[222:root:4e]deconstruct_session_id:380 decode session id ok, user=[editor],group=[sslvpngroup],authserver=[],portal=[my-full-tunnel-portal],host=[192.168.10.31],realm=[],idx=0,auth=1,sid=5f3dcc38, login=1603843029, access=1603843029
[222:root:4e]deconstruct_session_id:380 decode session id ok, user=[editor],group=[sslvpngroup],authserver=[],portal=[my-full-tunnel-portal],host=[192.168.10.31],realm=[],idx=0,auth=1,sid=5f3dcc38, login=1603843029, access=1603843029
[222:root:4e]deconstruct_session_id:380 decode session id ok, user=[editor],group=[sslvpngroup],authserver=[],portal=[my-full-tunnel-portal],host=[192.168.10.31],realm=[],idx=0,auth=1,sid=5f3dcc38, login=1603843029, access=1603843029
[222:root:4e]sslvpn_read_request_common,639, ret=-1 error=-1, sconn=0x55d52900.
[222:root:4e]Destroy sconn 0x55d52900, connSize=0. (root)

    3 replies

    Jobert
    JobertAuthor
    New Member
    October 28, 2020

    Hey guys, I figured it out in the end – FortiClient has some sort of bug that was causing the issue. To troubleshoot this yourself if you have this error, try eliminate the client as the issue by accessing the web portal through a web browser via https://xxx.xxx.xxx.xxx:yyy/ where x is your IP and y is your port. Updating FortiClient to the newest version resolved the issue.

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    October 28, 2020

    I still think something had happened to the 50E side, which no longer happens, if everybody had the same symptom. The sslvpnd log showed everything went through normally including user authentication, then drops at the end with an error.

    Jobert
    JobertAuthor
    New Member
    October 28, 2020

    toshiesumi wrote:

    I still think something had happened to the 50E side, which no longer happens, if everybody had the same symptom. The sslvpnd log showed everything went through normally including user authentication, then drops at the end with an error. 

    I thought so too but nothing seemed to fix it when I was troubleshooting on the host side, but updating the client fixed the issue immediately. I'll report back if the error comes back.

    Terms & ConditionsAccessibility statement
    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.