New Member

Question

FortiClient VPN disconnect occasionally during remote session

Forum|Forum|4 years ago
October 1, 2021
11 replies
81136 views

Hello,

Very happy with the ForitClient VPN for the purpose of remote desktop to my office computer.

Lately, after updating the Client to version 7.0.1.0083 , I noticed that every time I leave my PC for few minutes (making me some coffee) when I return the VPN is disconnected. This is something new that didn't occur while using the previous version.

I attach a logfile with few occurrences of disconnection.

Basically what I see in the log file is:

10/1/2021 10:17:33 AM error sslvpn FortiSslvpn: 36320: error: poll_send_ssl ->SSL_get_error(): 5, try:1 10/1/2021 10:17:33 AM error sslvpn FortiSslvpn: 36320: error: poll_send_ssl -> [style="background-color: #ffff00;"]WSAGetLastError():2745[/style], try:1 10/1/2021 10:17:33 AM error sslvpn FortiSslvpn: 36320: error: poll_send_ssl ->data size: 51, try:1 10/1/2021 10:17:33 AM error sslvpn FortiSslvpn: 36320: [handle_driver_read_event]: error: poll_send 10/1/2021 10:17:35 AM info sslvpn FortiSslvpn: 26580: Ras: connection to fortissl terminated

Searched for this: WSAGetLastError():2745 and found this in FORTINET:

FortiClients can sometimes have connection issues with SSLVPN. This sometimes includes error messages as follows:

Error VPN FortiSslvpn: 2148: error: poll_send_ssl -> WSAGetLastError():2745, try:1 Error VPN FortiSslvpn: 10908: error: poll_recv_ssl -> WSAGetLastError():2746

These errors are Windows Socket event errors, expressed in hexadeximal format. WSAGetLastError():2745, is the equivalent of error code 10053.

And the error code 10053 in Windows socket error codes list:

WSAECONNABORTED10053Software caused connection abort.An established connection was aborted by the software in your host computer, possibly due to a data transmission time-out or protocol error.

So, it seems like something in my Host computer that disconnect the connection.

What should I look for? Any idea?

Thanks for your help,

Eylon

ccn-techsupport

New Member

Is there any solution to this problem? We are facing the same issue?

KrystianNet

New Member

We have same issue.

Did You find out any solution for this?

We were trying on muliple FC versions. Same result for random workstations.

jzaka

New Member

We have the same issue. I was wondering if anybody found a solution to this issue?

We have multiple FC versions. The error below seems to be common denominator. Thank you.

"sslvpn FortiSslvpn: 15780: error: WSAEnumNetworkEvents FD_CLOSE (10053)"

Arzkaz

Visitor III

Just identical with my case...Still no ideas?

JTOLvF2

New Member

I am currently looking into this issue as well. Some things we have noticed however is that this is happening exclusively to users with a cable connection xfinity/comcast/spectrum. All disconnects are proceeded by WSAEnumNetworkEvents FD_CLOSE (10053). After switching to another provider even a hotspot the connection is stable for the user and no longer disconnects.

Edoardo76

Visitor III

Someone have idea how to fix it?

Arzkaz

Visitor III

In my case, upgrading client to 7.0.6 helped a lot.

Edoardo76

Visitor III

we still have it with 7.0.7 :(

miciti

Visitor III

We had to activate "DTLS Tunnel" in FortiClient settings to get a stable connection. Maybe that works for you too

Rob_Complan

New Member

Where do find the option "DTLS Tunnel" in FortiClient settings?

Or did you mean in the settings of the Fortinet Firewall?

MarcAbaya1

New Member

Has anyone figured-out what's causing this?

DerekWSmall

Explorer

Has anyone gotten anywhere on this? I have a customer with Verzion Buisness as their primary ISP. I have trouble VPN'ing to several other customers when I am onsite and using their Verizon Internet. They have Fortigate Firewalls as well. If I do packet captures, I the TCP three-way hand-shake, then a FIN-ACK and an ACK, then nothing. The Forticlient complains about a TLS version mis-match, but the packet capture shows that we don't even get to the TLS negotiation. I've tried several versions of FortiClient, the latest being 7.0.6.

I'm trying to VPN in from a VMware VM running on my laptop. If I switch my laptop to a tethered connection on my Verizon cell phone, I have no problems. But if I try to bring up the VPN tunnel while my laptop is on the customer network, it always fails at about 40%.

PierrePaulDuval

Visitor III

Thought I would chime in. I have some insights regarding this issue. I work for Retraite Quebec and we recently switched our VPN client, Cisco AnyConnect, to FortiNet. Unfortunately, we started with version 7.0.7 which was an almost horrible experience with the VPN (all the other parts are fine, thank god):
- VPN : Very frequent disconnecting for almost all users;

- MFA stopped working (getting notifications or insert pin);

- Prompting users for admin priv. when starting Forticlient;

- For those who have "ConnectBeforeLogon", the shield (credential provider) would show at Windows login, so no connectbeforelogon. Users logs in with Windows as cred. prov. then connects to VPN;

- Getting toast notified 150 TIMES a day telling me there is a problem with the FortiClient addon in Edge and I need to reinstall it. That was a PAIN. I simply turned it off via GPO.

Don't get me wrong, it's a cool product, speed is very nice, big upgrade from Cisco and ConnectBeforeLogon fixed at least 5 or 6 things because the user has now access to the network.

BUT

The more I read about this issue (frequent vpn drop) on forums, the more I realize that this didn't start last month or last year. It's been years. We tried a LOT of things. But ultimately, we decided to install the "latest but not really latest version : 7.0.8". I say this because 7.2 came out before 7.0.8. So this tells me that issues in 7.0.7 were significantly important to patch it AFTER 7.2 came out.

Here's one great advice: Update your Wifi device drivers and disable the MIMO power save mode
https://www.intel.ca/content/www/ca/en/support/articles/000005585/wireless/legacy-intel-wireless-products.html

Why disable? Because all antennas on your wifi card will be powered and ready when your PC or laptop is in all the other state than normal :). I guessed this could help and it did.

After upgrading to 7.0.8 and updated all wifi devices driver (plus disabled powersavemode), the VPN drops went wayyyy down but we still do have some occasionally.

If there is one thing Cisco was very good at : Incredible stable connection. I miss that. Am I the only one that doesn't think it is normal to see your VPN break when you change your WiFi connection to another one (ex: 2.4 to 5Ghz) ?

Thanks!

ivanov_ip

Visitor III

Can confirm! Your solution does work, and fixes the issue!

For everyone else: just change Auto SMPS mode to No SMPS in MIMO power save mode setting inside Advanced device configuration properties (you can reach this window through Device Manager -> Network adapters or Settings -> Networks -> Wi-Fi -> Hardware properties). That's all!