Hi,

There could be multiple factors that cause the SSLVPN connection failed at 40% as mentioned in below document:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Possible-reasons-for-FortiClient-SSL-VPN/ta-p/211965

It is suggested to execute below debug commands in the FortiGate CLI and reproduce this issue so we can have more visibility on the issue:

diagnose debug disable
diagnose debug reset
diagnose debug application sslvpn -1

diagnose debug application fnbamd -1

diagnose debug enable

As in the KB @GeorgeZhong referred to, 40% means it could be a TLS or certificate issue. 
But did you check "diag debug config-error-log read" when you upgraded to 7.2.12? It might have lost something during the config conversion. Or if you're using default "Fortinet_Factory" cert for SSL VPN, that might have gotten corrupted. In that case you should be able to see some config errors in the diag command.
We recently (last week) upgraded one of our 1000F clusters from 7.2.11 to 7.2.12 due to NP7 related bugs. But SSL VPN on that cluster is still working fine.

By the way, "diag debug app sslvpn -1" would give you the clue, if not the answer, why it drops the connection attempts during the negotiation.

Toshi 

Hi @ERK and @HMIndustrialEPC,

Thank you very much for sharing. Please find the Fortinet document for this behaviour change.

https://docs.fortinet.com/document/fortigate/7.2.12/fortios-release-notes/684249/saml-certificate-verification

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SAML-Authentication-fails-after-firmware/ta-p/407859

Regards,

George

https://community.fortinet.com/t5/Support-Forum/SSL-VPN-Doesn-t-work-after-firmware-update-7-2-12/td-p/412523

SSL VPN not supported on FortiGate G-series Entry-Level models

We were running 7.2.11.1241 perfectly with Saml (Entra ID) authentication. Since update to 7.2.12.1269 due to high vulnerability in previous version, connection is now broken. It connects successfully but will simply disconnect right behind. on some occasion it will also remain stuck to 98%. clean install, clean PC, easily reproducible on several machine. Running Windows 11 25h2 and latest November update. I tried to change the saml parameters as described below but same behavior. I can't neither update to 7.4.4 because we only need the FortclientVPN Client and not the full suite. Please release a new 7.2.13 ASAP that could fix this issue !

parameters of the client as below (always worked in the past with previous versions).

SSL Options:

enable single sign on ==> ticked

use external browser as user agent.. ==> unticked

enable autologin with azure active directory ==> unticked

enable dual stack ==> unticked

VPN Options:

Preferred DTLS Tunnel ==> ticked

Do not modify internal cookies ==> ticked

do not warn invalid cer ==> unticked

Thank you

I know this is marked as resolved, but I also just ran into this issue using Entra as my IdP. It turns out the update modified my SAML attributes for identifying users and groups.

The update changed my user id attribute from "username" to "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"

It also changed the group id attribute from "group" to "http://schemas.xmlsoap.org/claims/Group"

Changing these values back and implementing @ERK's solution ended up resolving my problem.