Skip to main content
tonym
tonym
New Member
August 3, 2021
Question

N/A User in SSL VPN

  • August 3, 2021
  • 2 replies
  • 8402 views

Hello,

 

Just want to ask if someone encounter this already. I'm looking at FortiView VPN tab seeing User=n/a with 45mins ago last connection time and a duration of 22h 12m. Can someone explain why there is a n/a user?

 

SSL vpn was setup using only a local user created in the firewall. All user who successfully established a tunnel will be authenticated properly that's why their identity was recorded under "User". Why there is an N/A, is this a failed attempt to ssl vpn? See screenshot below for reference. Thank you in advance whoever give feedback about this

      2 replies

      xSyKoTiKx
      xSyKoTiKx
      Visitor III
      February 24, 2022

      I came to find the answer to that same question, but it seems you and I are the only ones asking it.

      Debbie_FTNT
      Staff & Editor
      Debbie_FTNT
      Staff & Editor
      February 25, 2022

      Hey SyKoTiK,

      are your logs the exact same (user N/A, tunneltype ssl instead of ssl-tunnel/ssl-web)?

      When an SSLVPN connection is established, FortiClient may open multiple tunnels at the same time; sometimes one of them doesn't establish properly and you might end up with something like a zombie tunnel with no associated user, and no specific tunnel type.

      There shouldn't be any traffic flowing through it.

      Sativa23
      Sativa23
      New Member
      May 11, 2023

      I have the same.  Traffic is passing though ?

       

      n/a usern/a user

      rosatechnocrat
      rosatechnocrat
      Explorer III
      May 11, 2023

       

      * Oftentimes the "N/A" user just means that either the log entry itself doesn't track userinfo, or that no username was provided.
      * For example: site-to-site IPsec tunnels frequently don't use usernames for authentication, and therefore any logs for those would show the user field as "N/A".
      *  "SSL VPN new connection", do not track the username on that specific log entry. 
      * If you look at a bunch of those logs at the same timestamp you will, however, usually be able to see a log entry with the actual user who connected. You can correlate these logs with the "remoteip" field to see if the log is referring to the same remote host.
      * Ultimately so long as you don't see many failed login attempts, especially coming from remote-IPs in unexpected countries, the risk is not very high.
      * You can check the country of the remote IP from the FortiGate command line as follows: diagnose firewall ipgeo ip2country x.x.x.x <----- enter remote IP there
      + Same information you can check in FortiGate as well, by following below steps.
      >Logs & Report > Events > System Events .

      Subscribe "ROSA Technocrat" on Youtube for Fortinet Videos and Troubleshooting https://www.youtube.com/@rosatechnocrat
        Terms & ConditionsAccessibility statement