SSL VPN Connection Error with LDAP

Hi,

Would you please try to follow the article reference given below;

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-Troubleshooting/ta-p/189542

You can also try to connect the SSL VPN using the web portal bypassing the FortiClient.

If you are using LDAP user then you can follow the article reference given below to check the user.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate-LDAP-troubleshooting-and-debug/ta-p/196280

Hi @RolandBaumgaertner72,

On FortiGate LDAP server config, can you try to test the username/password and see first of all if it is able to authenticate? 

Regards,

Hello @RolandBaumgaertner72 

Are you using any MFA for LDAP users?

Please check this document if forticlient is stopping at 48% it seems issue with MFA.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Possible-reasons-for-FortiClient-SSL-VPN/ta-p/211965

Hello @RolandBaumgaertner72 

Kindly refer to the following documents
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-Debugs-Error-sslvpn-login-unknown/ta-p/232020

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/115783/ssl-vpn-with-ldap-user-authentication

Hello,

we have no MFA in place. In the Web Mode I get the same message, connection denied. Again, with the local user I can connect via Forticlient and also via web mode. So there is an issue with users in LDAP. Both my users, the local one and also the LDAP is in the same group and also in the same policy so this is also OK. Also I tried my user with the LDAP connection and got OK, also we tried with other users from LDAP and the same problem.

The SSL VPN was working with the old FGs, so we just copied the same configuration.

2024-10-22 19:58:34 [385:root:57]sslvpn_validate_user_group_list:2613 rule 1 done, got user (0:0) group (1:0) peer group (0).
2024-10-22 19:58:34 [385:root:57]sslvpn_validate_user_group_list:2050 checking rule 2 cipher.
2024-10-22 19:58:34 [385:root:57]sslvpn_validate_user_group_list:2058 checking rule 2 realm.
2024-10-22 19:58:34 [385:root:57]sslvpn_validate_user_group_list:2069 checking rule 2 source intf.
2024-10-22 19:58:34 [385:root:57]sslvpn_validate_user_group_list:2613 rule 2 done, got user (0:0) group (11:0) peer group (0).
2024-10-22 19:58:34 [385:root:57]sslvpn_validate_user_group_list:2621 got user (0:0) group (11:0) peer group (0).
2024-10-22 19:58:34 [385:root:57]sslvpn_validate_user_group_list:2968 got user (0:0), group (11:0) peer group (0).
2024-10-22 19:58:34 [385:root:57]sslvpn_update_user_group_list:1850 got user (0:0), group (11:0), peer group (0) after update.
2024-10-22 19:58:34 [385:root:57]two factor check for Roland Baumgaertner: off
2024-10-22 19:58:34 [385:root:57]sslvpn_authenticate_user:203 authenticate user: [XXXX]
2024-10-22 19:58:34 [385:root:57]sslvpn_authenticate_user:221 create fam state
2024-10-22 19:58:34 [385:root:57][fam_auth_send_req_internal:432] Groups sent to FNBAM:
2024-10-22 19:58:34 [385:root:57]group_desc[0].grpname = VPN SSL XX
2024-10-22 19:58:34 [385:root:57]group_desc[1].grpname = VPN SSL XX
2024-10-22 19:58:34 [385:root:57]group_desc[2].grpname = VPN SSL XX
2024-10-22 19:58:34 [385:root:57]group_desc[3].grpname = VPN SSL XX
2024-10-22 19:58:34 [385:root:57]group_desc[4].grpname = VPN SSL XX
2024-10-22 19:58:34 [385:root:57]group_desc[5].grpname = VPN SSL XX
2024-10-22 19:58:34 [385:root:57]group_desc[6].grpname = VPN SSL XX
2024-10-22 19:58:34 [385:root:57]group_desc[7].grpname = VPN SSL XX
2024-10-22 19:58:34 [385:root:57]group_desc[8].grpname = VPN SSL XX
2024-10-22 19:58:34 [385:root:57]group_desc[9].grpname = VPN SSL XX
2024-10-22 19:58:34 [385:root:57]group_desc[10].grpname = VPN SSL Azure
2024-10-22 19:58:34 [385:root:57][fam_auth_send_req_internal:444] FNBAM opt = 0X200420
2024-10-22 19:58:34 [385:root:57]fam_auth_send_req_internal:513 fnbam_auth return: 4
2024-10-22 19:58:34 [385:root:57]fam_auth_proc_resp:1365 fnbam_auth_update_result return: 5 ((null))
2024-10-22 19:58:34 [385:root:57][fam_auth_proc_resp:1371] An error happened updating the FNBAM response.
2024-10-22 19:58:34 [385:root:57][fam_auth_proc_resp:1505] Authenticated groups (11) by FNBAM with auth_type (1):
2024-10-22 19:58:34 [385:root:57]Received: auth_rsp_data.grp_list[0] = 0
2024-10-22 19:58:34 [385:root:57]Received: auth_rsp_data.grp_list[1] = 0
2024-10-22 19:58:34 [385:root:57]Received: auth_rsp_data.grp_list[2] = 0
2024-10-22 19:58:34 [385:root:57]Received: auth_rsp_data.grp_list[3] = 0
2024-10-22 19:58:34 [385:root:57]Received: auth_rsp_data.grp_list[4] = 0
2024-10-22 19:58:34 [385:root:57]Received: auth_rsp_data.grp_list[5] = 0
2024-10-22 19:58:34 [385:root:57]Received: auth_rsp_data.grp_list[6] = 0
2024-10-22 19:58:34 [385:root:57]Received: auth_rsp_data.grp_list[7] = 0
2024-10-22 19:58:34 [385:root:57]Received: auth_rsp_data.grp_list[8] = 0
2024-10-22 19:58:34 [385:root:57]Received: auth_rsp_data.grp_list[9] = 0
2024-10-22 19:58:34 [385:root:57]Received: auth_rsp_data.grp_list[10] = 13630032
2024-10-22 19:58:34 [385:root:57]login_failed:480 user[XXXX],auth_type=1 failed [sslvpn_login_unknown_user]
2024-10-22 19:58:34 [385:root:57]Transfer-Encoding n/a
2024-10-22 19:58:34 [385:root:57]Content-Length 237

Hi,

since local user work fine and since we have 5 other sites with FG and SSL VPN we are sure that it is a Certificate problem.

From auf DC we are not able to export PKCS #12 certificate and honestly I dont remember how we did it on the other FGs. Since I dont have access to the servers I am lost now. We need to get the cert from the DC and import it to this new FG.

Any help? Thanks a lot!!

Hi,

we still have some strange behavior but now on all our FGs. We got support via remote from Fortinet and connecting and testing it worked just fine. We didnt change anything from our side but it is possible that our main headquarter changed something on the DCs. So after that we suddenly had problems (we use the same cert in all FGs) on other FGs who suddenly could not connect to the LDAP.

Today, all of them work fine. Why? I dont know....

Thanks