Skip to main content
HossTosson
HossTosson
New Member
August 14, 2024
Question

SSL VPN

  • August 14, 2024
  • 10 replies
  • 5203 views

configuring ssl vpn on firewall but after finishing, i cannot connect from outside to the internal network using Forti client vpn

10 replies

ozkanaltas
ozkanaltas
Valued Contributor III
August 14, 2024

Hello @HossTosson ,

 

What kind of error are you getting? Can you share your configuration with us?

 

Also, can you run the following commands while trying to connect to SSL-VPN and share the output with us?

 

diagnose debug application sslvpn -1
diagnose debug enable

    HossTosson
    HossTossonAuthor
    New Member
    August 14, 2024

    you want me to run the above commands in fortigate firewall terminal, right?

    johnathan
    Staff
    johnathan
    Staff
    August 14, 2024

    Correct, this would be the icon in the top right of your screen that looks like this: >_

    Never trust a computer you can't throw out a window.
      patelr
      Staff
      patelr
      Staff
      August 14, 2024

      Hello @HossTosson,

       

      Please review https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Possible-reasons-for-FortiClient-SSL-VPN/ta-p/211965 as this document will provide you with a quick overview of the percentage at which your connection is being terminated.  

       

      Thanks,

      Ronak Patel

        HossTosson
        HossTossonAuthor
        New Member
        August 14, 2024

        the percentage i reach while tryin to connect is 10%

        ozkanaltas
        ozkanaltas
        Valued Contributor III
        August 14, 2024

        Hello @HossTosson, 

         

        You have a public IP address defined on the FortiGate that can be accessed from all over the world, right?

         

        Or is there a device such as a router/modem in front of the FortiGate?

          HossTosson
          HossTossonAuthor
          New Member
          August 14, 2024

          no. i have a router in front of fortigate.

          ozkanaltas
          ozkanaltas
          Valued Contributor III
          August 14, 2024

          Hello @HossTosson ,

           

          If this router does not directly transfer the public IP address to the FortiGate, you need to perform DNAT for the ssl-vpn port on this router.

           

          This is probably the cause of your connection problem.

           

           

          HossTosson
          HossTossonAuthor
          New Member
          August 14, 2024

          sorry i am not that expert with firewall. what do you mean by DNAT?

          ozkanaltas
          ozkanaltas
          Valued Contributor III
          August 14, 2024

          Hello @HossTosson ,

           

          DNAT means Destination Nat or port forwarding. 

           

          This configuration will vary depending on the brand and model of the router. If you search by typing the brand and model of your device and port forwarding or destination nat, you can see configuration examples.

          HossTosson
          HossTossonAuthor
          New Member
          August 15, 2024

          and this port forwarding will be done from the router or firewall?

          ozkanaltas
          ozkanaltas
          Valued Contributor III
          August 15, 2024

          Hello @HossTosson ,

           

          This should be done on the router.

          arahman
          Staff
          arahman
          Staff
          August 15, 2024

          also you can do the sniffer on the FortiGate with the port you are trying to connect the ssl vpn and see if the packets are coming on the FortiGate and what ip it is coming with 
          diag sniffer packet any ' port <port number for sslvpn> ' 4 0 l

          Shashwati
          Staff
          Shashwati
          Staff
          August 15, 2024

          Hello , 

           

          Please collect the packet capture on Firewall using command while testing connection

           

          diagnose sniffer packet any 'host [Firewall public IP address]' 4 0 l

           

          Check that IPV6 is disabled on the user machine under  Network Adapter setting

           

           

          FortiArt
          Staff
          FortiArt
          Staff
          August 15, 2024

          Did you confirmed firmware compatibility between fortigate and forticlient. Is this connection problem only for specific user(s) and using specific operating system. Have you tried to disable Windows firewall and other security software and test. Try different forticlient firmware versions. Compare sslvpn configuration on fortigate and foricleint and try to connect using web-mode sslvpn to confirm if this forticlient issue or configuration issue. If forticlient stuck at 10% this indicate a problem on the source PC and traffic is not leaving that PC. If forticlient stuck at %40 this mean authentication problem and you can try to add local user to sslvpn group and test. If forticlient stuck anywhere above 80% this could be connectivity problem and you can run:

           

          diagnose vpn ssl debug-filter src-addr4 x.x.x.x <- external ip address of source PC

          diagnose debug application sslvpn -1

          diagnose debug enable

           

          Check the output of the above debug commands that may help in finding the root cause.

           

          https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-Troubleshooting/ta-p/189542

           

          Hope this help

          Terms & ConditionsAccessibility statement