New Member

Question

FortiClient VPN - 7.4 with SAML SSO with Azure AD crashes and does not connect

Forum|Forum|2 years ago
August 7, 2024
13 replies
9833 views

Hello Guys,

We have quite a problem with the VPN after two simultaneous steps:
1. Migrating from version 7.2.4 to 7.4. We are using free version of FortiClient VPN 7.4.0.1658.
2. Changing the authentication from user auth to SAML SSO login for SSL VPN with Azure AD acting as SAML IdP (with external browser as user-agent for saml user authentication).

As a result, we observe 2 main problems:
1. connection crashes at 98%
2. connection does not start at all - percentages not showing the progress of connection

This happens on both Win10 and Win11. The problems are not deterministic - one day they occur on a particular client, the next day they are fine. Sometimes reinstalling the VPN client helps for a while. Sometimes you have to retry, and after several attempts it will finally connect.

Logs are attached below. I would appreciate any tips and help.

"30/07/2024 08:52:12	warning	sslvpn	CSslvpnAgent::InitPipeHandle() 137 CreateFile() failed.. LastError=231" "30/07/2024 08:54:13	error	sslvpn	error: ras_loop(), waitResult=258." "30/07/2024 08:55:49	error	sslvpn	date=2024-07-30 time=08:55:48 logver=1 id=96603 type=securityevent subtype=sslvpn eventtype=error level=error uid=xxx devid=xxx hostname=xxx pcdomain=xxx deviceip=192.168.1.10 devicemac=xxx site=N/A fctver=7.4.0.1658 fgtserial=xxx emsserial=N/A os="Microsoft Windows 10 Professional Edition, 64-bit (build 19045)" user=xxx msg="SSLVPN tunnel connection failed" vpnstate= vpntunnel=CLVPN-Azure remotegw=xxx"  8/1/2024 3:22:21 PM	warning	sslvpn	CSslvpnAgent::InitPipeHandle() 137 CreateFile() failed.. LastError=231 8/1/2024 5:22:50 PM	error	sslvpn	error: WSAEnumNetworkEvents FD_CLOSE (10053) 8/1/2024 5:37:00 PM	error	sslvpn	error: poll_recv_ssl -> SSL_get_error(): 5 8/1/2024 5:37:00 PM	error	sslvpn	error: poll_recv_ssl -> WSAGetLastError():2746  05/08/2024 11:05:29	error	sslvpn	error: ras_loop(), waitResult=1. 05/08/2024 11:05:29	error	sslvpn	failed to create tunnel_thread thread 05/08/2024 11:05:29	error	sslvpn	failed to create ras_thread thread 05/08/2024 11:05:29	error	sslvpn	failed to create monitor_thread thread 05/08/2024 11:06:06	error	sslvpn	error: ras_loop(), waitResult=1. 05/08/2024 11:06:06	error	sslvpn	failed to create tunnel_thread thread 05/08/2024 11:06:06	error	sslvpn	failed to create ras_thread thread 05/08/2024 11:06:06	error	sslvpn	failed to create monitor_thread thread 05/08/2024 11:06:36	info	sslvpn	date=2024-08-05 time=11:06:35 logver=1 id=96600 type=securityevent subtype=sslvpn eventtype=status level=info uid=xxx devid=xxx hostname=xxx pcdomain=xxx deviceip=172.29.208.1 devicemac=xxx site=N/A fctver=7.4.0.1658 fgtserial=xxx emsserial=N/A os="Microsoft Windows 10 Professional Edition, 64-bit (build 19045)" user=xxx msg="SSLVPN tunnel status" vpnstate=disconnected vpntunnel=CLVPN-Azure

patelr

Staff

Hello @rabbit23 ,

Please check https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-fails-at-98/ta-p/248363 and review FortiClient logs, as it will provide descriptive information on why connection is getting terminated at 98%. To enable logs on FortiClient, please review https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-enable-debug-log-in-FortiClient/ta-p/190433.

Thanks,

Ronak Patel

rabbit23Author

New Member

Thank you. Debug was enabled for 3 machines where I collected above logs from. I'll check IPv6 as it might be enabled.

Shashwati

Staff

Hello,

Regarding the error error: poll_recv_ssl -> WSAGetLastError():2746, please refer to the following document

https://community.fortinet.com/t5/FortiClient/Technical-Tip-Interpreting-WSAGetLastError-in-FortiClient-Debug/ta-p/191800

rabbit23Author

New Member

What does it mean? "An established connection was aborted by the software in the host computer, possibly due to a data transmission time-put or protocol error."

This is frequent issue, not one-time only. On same host it sometimes works sometimes not therefore how it might be protocol issue?

Hong_FTNT

Staff & Editor

Hi @rabbit23,

Did you have issues on FortiClient 7.2.4? Do you have any third party antivirus or VPN client installed?

Regards,

ndumaj

Staff

Hello @rabbit23

Please perform steps one by one, upgrading FCT from 7.2.4 to 7.4.0 does it work or not?
Does the setup work on Web SSL mode?

Does the SSL VPN in Web mode with Azure AD acting as SAML works?
Please enable the following debug:

diagnose debug reset

diagnose debug console timestamp enable

diagnose debug application samld -1

diagnose debug application sslvpn -1

diagnose debug enable

BR

AGU_HD

Explorer

Hi Rabbit,

Trying installing this Visual Studio Redistributable: https://aka.ms/vs/17/release/vc_redist.x64.exe

The Forticlient VPN Application is trying to start fortitray.exe, but it needs a .dll file to work (mfc140u.dll) which is missing from Windows.

After installing and a reboot, your Forticlient VPN app should work again.

joshk_apollo

New Member

I think it may be 2 separate issues. The 98% is new (to me) and wasn't happening with an older version of FC - 7.2.something. Disabling IPv6 appears to have resolved that issue.

The other issue appears to be a timeout of some sort but I don't seem to be able to pinpoint which setting controls it. If I run through the Azure auth quickly in <~30 seconds including MFA it connects fine. If I take longer, say slow rolling approval in app I get the above error.