New Member

Question

SSL VPN

17 replies
5258 views

configuring ssl vpn on firewall but after finishing, i cannot connect from outside to the internal network using Forti client vpn

FortiGate

ozkanaltas

Valued Contributor III

Hello @HossTosson ,

What kind of error are you getting? Can you share your configuration with us?

Also, can you run the following commands while trying to connect to SSL-VPN and share the output with us?

diagnose debug application sslvpn -1
diagnose debug enable

HossTossonAuthor

New Member

you want me to run the above commands in fortigate firewall terminal, right?

johnathan

Staff

Correct, this would be the icon in the top right of your screen that looks like this: >_

Never trust a computer you can't throw out a window.

patelr

Staff

Hello @HossTosson,

Please review https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Possible-reasons-for-FortiClient-SSL-VPN/ta-p/211965 as this document will provide you with a quick overview of the percentage at which your connection is being terminated.

Thanks,

Ronak Patel

HossTossonAuthor

New Member

the percentage i reach while tryin to connect is 10%

ozkanaltas

Valued Contributor III

Hello @HossTosson,

You have a public IP address defined on the FortiGate that can be accessed from all over the world, right?

Or is there a device such as a router/modem in front of the FortiGate?

HossTossonAuthor

New Member

no. i have a router in front of fortigate.

ozkanaltas

Valued Contributor III

Hello @HossTosson ,

If this router does not directly transfer the public IP address to the FortiGate, you need to perform DNAT for the ssl-vpn port on this router.

This is probably the cause of your connection problem.

HossTossonAuthor

New Member

sorry i am not that expert with firewall. what do you mean by DNAT?

ozkanaltas

Valued Contributor III

Hello @HossTosson ,

DNAT means Destination Nat or port forwarding.

This configuration will vary depending on the brand and model of the router. If you search by typing the brand and model of your device and port forwarding or destination nat, you can see configuration examples.

HossTossonAuthor

New Member

and this port forwarding will be done from the router or firewall?

ozkanaltas

Valued Contributor III

Hello @HossTosson ,

This should be done on the router.

arahman

Staff

also you can do the sniffer on the FortiGate with the port you are trying to connect the ssl vpn and see if the packets are coming on the FortiGate and what ip it is coming with
diag sniffer packet any ' port <port number for sslvpn> ' 4 0 l

Shashwati

Staff

Hello ,

Please collect the packet capture on Firewall using command while testing connection

diagnose sniffer packet any 'host [Firewall public IP address]' 4 0 l

Check that IPV6 is disabled on the user machine under Network Adapter setting

FortiArt

Staff

Did you confirmed firmware compatibility between fortigate and forticlient. Is this connection problem only for specific user(s) and using specific operating system. Have you tried to disable Windows firewall and other security software and test. Try different forticlient firmware versions. Compare sslvpn configuration on fortigate and foricleint and try to connect using web-mode sslvpn to confirm if this forticlient issue or configuration issue. If forticlient stuck at 10% this indicate a problem on the source PC and traffic is not leaving that PC. If forticlient stuck at %40 this mean authentication problem and you can try to add local user to sslvpn group and test. If forticlient stuck anywhere above 80% this could be connectivity problem and you can run:

diagnose vpn ssl debug-filter src-addr4 x.x.x.x <- external ip address of source PC

diagnose debug application sslvpn -1

diagnose debug enable

Check the output of the above debug commands that may help in finding the root cause.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-Troubleshooting/ta-p/189542

Hope this help

Sign up

Login with SSO

Login to the community

Login with SSO