Skip to main content
Arye_R
Arye_R
Visitor III
March 1, 2024
Question

SSL VPN disconnection due to short network disconnections at home

  • March 1, 2024
  • 4 replies
  • 5142 views

I have a VPN client that connects from home to our FW, and what happens is that once every half an hour he has a short network drop for a few seconds and when this happens the SSL VPN software disconnects and he has to perform the connection process over again.

Is it possible to extend the duration of the reconnection attempts and the user will not have to type the confirmations again?

4 replies

hbac
Staff
hbac
Staff
March 1, 2024

Hi @Arye_R,

 

I would suggest enabling dtls and increase heartbeat timeouts. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-DTLS-to-improve-SSL-VPN-performance/ta-p/193881

 

dtls-hello-timeout                      >>> SSLVPN maximum DTLS hello timeout (10 - 60 sec, default = 10).
dtls-heartbeat-idle-timeout        >>> Idle timeout before DTLS heartbeat is sent.
dtls-heartbeat-interval               >>> Interval between DTLS heartbeat.
dtls-heartbeat-fail-count            >>> Number of missing heartbeats before the connection is considered dropped.

 

Regards, 

Arye_R
Arye_RAuthor
Visitor III
March 3, 2024

I thank you,

Could you direct me more specifically to which line you indicated to refer to ?

 

In addition, will it be possible that some of the commands you brought are not supported in version 7.2.7?
For example:

FW2 (settings) # dtls-heartbeat-fail-count 5
Unknown action 0

hbac
Staff
hbac
Staff
March 4, 2024

@Arye_R,

 

You need to run 'set' first. For example: 

 

config vpn ssl settings 

set dtls-heartbeat-fail-count 5

end 

 

Regards, 

Rajan_kohli
Staff
Rajan_kohli
Staff
March 3, 2024

Hi @Arye_R,

 

You can use CLI refrence to verify commands supported by FortiOS 7.2.7 for ssl vpn settings
Ref: https://docs.fortinet.com/document/fortigate/7.2.7/cli-reference/319620/config-vpn-ssl-settings

Thanks

Rajan

Dhruvin_patel
Staff
Dhruvin_patel
Staff
March 3, 2024

Hello @Arye_R

 

It is expected to get disconnected after 6 seconds once there is a network interruption. 

In this case, you can set option always-up, https://docs.fortinet.com/document/forticlient/7.2.3/administration-guide/437773/save-password-auto-connect-and-always-up

 

Enabling the "Auto Connect", "Always UP" or "Save Password" options can only be done by editing the FortiClient XML configuration file (on non-managed installations.), https://community.fortinet.com/t5/FortiClient/Technical-Tip-FortiClient-EMS-Auto-connect-a-VPN-Tunnel/ta-p/195552

 

<show_remember_password>1</show_remember_password>
<show_alwaysup>1</show_alwaysup>
<show_autoconnect>1</show_autoconnect>

 

The same settings should be enabled under FW VPN portal settings or else it will keep prompting every time you login to your machine.

 

set auto-connect enable
set keep-alive enable
set save-password enable

 

Regards!

If you have found a solution, please like and accept it to make it easily accessible to others.

Terms & ConditionsAccessibility statement