Skip to main content
cparfon
cparfon
New Member
January 21, 2015
Solved

ssl-vpn on FG200D

  • January 21, 2015
  • 5 replies
  • 13823 views

Hello,

 

I have a issue with one of our companies people, which has to work from China. We have a FG200D and it's running a ssl-vpn. All our employees are able to connect to the office network through the SSL-VPN but this one fella which works from China isn't able to connect. I'm very much aware that in China they have lots of restrictions but I was just looking for a way to work this out somehow. Any ideas?

 

Thanks.

    Best answer by sensorsinc

    China recently "upgraded" their Great Firewall and is actively monitoring and blocking VPNs in real-time.

     

    http://techcrunch.com/2015/01/23/china-vpn-crackdown/

    http://www.wsj.com/articles/chinas-great-firewall-gets-taller-1422607143

     

    There are VPN providers who are actively working around the issue.  Astrill (https://www.astrill.com) for example is supposed to work on everything but iOS.

     

    I just started my search here to see what FortiNet is doing about it. 

     

    If anyone knows of an official response from FortiNET I would like to hear about it.

     

    Good luck!

    5 replies

    Christopher_McMullan
    Staff
    Christopher_McMullan
    Staff
    January 21, 2015

    What port do users target to connect to the SSLVPN? If 10443 is the default, I would consider changing it to 443, and move the HTTPS GUI management port to 444, or 10443.

     

    I used the SSLVPN web portal on my home firewall to do some proxy browsing from Cuba while on vacation a couple years back, and I made sure to set the port to 443 in case other ports were blocked.

     

    Otherwise, try a sniff, flow trace, and debug of the sslvpn daemon sequentially to see what's happening:

    di sniff pack any "host w.x.y.z and port 443" 4 //--replace w.x.y.z with the public IP of the FortiGate people target for their SSLVPN connections

    <attempt a connection, then press Ctl+C to stop the capture>

     

    di de reset

    di de en

    di de fl s c en

    di de fl s f en

    di de fl filter addr w.x.y.z //--same as above

    di de fl filter port 443 //--same as above

    di de fl tr start 5000

    di de fl tr stop //--type this without pressing Enter, so you can easily stop the flow trace later regardless of how much output is flying by

    <attempt a connection, then...>

    di de fl filter clear

    di de reset

     

    di de app sslvpn -1

    <attempt a connection, then...>

    di de reset

    di de di

    cparfon
    cparfonAuthor
    New Member
    January 22, 2015

    Hi Christopher,

     

    First, thank you for taking the time to answer my question.

     

    Second, to answer your question, we DO USE port 443 for the users to connect to the SSLVPN, and it works flawlessly for all of them, except for this one person which is located in China (Beijing).

     

    I did as you suggested and here's the traffic capture done during the connection attempt of that person from China (atached to this post).

    Btw, the public IP address in that capture belongs to our employee in China.

    Also, here's  `FortiClient` client log:

     

    1/7/2015 6:24:42 PM Notice FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 1/7/2015 6:24:42 PM Notice VPN id=96602 msg="SSLVPN service started successfully." vpntype=ssl 1/7/2015 6:24:57 PM Warning FortiShield id=96855 msg="FortiShield blocked application: FortiClientOnl from modifying: \\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Fortinet\\FortiClient\\FA_UPDATE\\SoftwareUpdate\\IgnoreVersion" 1/7/2015 7:26:50 PM Notice VPN date=2015-01-07 time=19:26:49 logver=1 type=traffic level=notice sessionid=25224176 hostname=P15P2GL-01 uid=E2BFA8B9FF2B4936924567E70ABDCDA5 devid=FCT8002984563811 fgtserial=N/A regip=N/A srcname=sslvpn srcip=N/A srcport=N/A direction=outbound remoteip=XX.XX.XX.XX remotename=N/A remoteport=443 url=N/A user=N/A proto=ssl rcvdbyte=1982452785 sentbyte=0 utmaction=passthrough utmevent=vpn threat=connect vd=N/A 1/7/2015 7:26:51 PM Notice VPN date=2015-01-07 time=19:26:50 logver=1 type=traffic level=notice sessionid=25224176 hostname=P15P2GL-01 uid=E2BFA8B9FF2B4936924567E70ABDCDA5 devid=FCT8002984563811 fgtserial=N/A regip=N/A srcname=sslvpn srcip=N/A srcport=N/A direction=outbound remoteip=XX.XX.XX.XX remotename=N/A remoteport=443 url=N/A user=lan.liu proto=ssl rcvdbyte=4294967296 sentbyte=0 utmaction=passthrough utmevent=vpn threat=disconnect vd=N/A 1/7/2015 7:27:05 PM Error VPN FortiSslvpn: 50416: Ras : connection to fortissl failed : 680:2:There was no dial tone. 1/7/2015 7:39:53 PM Error VPN FortiSslvpn: 45460: Ras : connection to fortissl failed : 0:0: 1/7/2015 7:44:01 PM Error VPN FortiSslvpn: 44504: Ras : connection to fortissl failed : 0:0: 1/7/2015 9:30:18 PM Error VPN FortiSslvpn: 25580: Ras : connection to fortissl failed : 0:8193: 1/7/2015 9:42:47 PM Error VPN FortiSslvpn: 34500: Ras : connection to fortissl failed : 0:0: 1/16/2015 4:06:42 AM Notice FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 1/16/2015 4:06:45 AM Notice VPN id=96602 msg="SSLVPN service started successfully." vpntype=ssl 1/19/2015 8:20:35 AM Notice FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 1/19/2015 8:20:38 AM Notice VPN id=96602 msg="SSLVPN service started successfully." vpntype=ssl 1/20/2015 8:43:39 AM Notice FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 1/20/2015 8:43:43 AM Notice VPN id=96602 msg="SSLVPN service started successfully." vpntype=ssl 1/22/2015 7:24:52 PM Notice VPN date=2015-01-22 time=19:24:51 logver=1 type=traffic level=notice sessionid=30401100 hostname=P15P2GL-01 uid=E2BFA8B9FF2B4936924567E70ABDCDA5 devid=FCT8002984563811 fgtserial=N/A regip=N/A srcname=sslvpn srcip=N/A srcport=N/A direction=outbound remoteip=XX.XX.XX.XX remotename=N/A remoteport=443 url=N/A user=N/A proto=ssl rcvdbyte=2000081969 sentbyte=0 utmaction=passthrough utmevent=vpn threat=connect vd=N/A 1/22/2015 7:24:52 PM Notice VPN date=2015-01-22 time=19:24:52 logver=1 type=traffic level=notice sessionid=30401100 hostname=P15P2GL-01 uid=E2BFA8B9FF2B4936924567E70ABDCDA5 devid=FCT8002984563811 fgtserial=N/A regip=N/A srcname=sslvpn srcip=N/A srcport=N/A direction=outbound remoteip=XX.XX.XX.XX remotename=N/A remoteport=443 url=N/A user=lan.liu proto=ssl rcvdbyte=4294967296 sentbyte=0 utmaction=passthrough utmevent=vpn threat=disconnect vd=N/A 1/22/2015 7:25:05 PM Error VPN FortiSslvpn: 17668: Ras : connection to fortissl failed : 0:8193: 1/22/2015 7:28:34 PM Error VPN FortiSslvpn: 16548: Ras : connection to fortissl failed : 0:0: 1/22/2015 7:32:48 PM Error VPN FortiSslvpn: 13132: Ras : connection to fortissl failed : 0:0:

    cparfon
    cparfonAuthor
    New Member
    January 22, 2015

    We have also tried SSLVPN web portal. Unfortunately no luck with it also. :(

    Christopher_McMullan
    Staff
    Christopher_McMullan
    Staff
    January 22, 2015

    Does it make any difference if they try connecting via a web browser to the SSLVPN web portal instead of using FortiClient?

     

    That'll help narrow the issue down, to see if a connection is possible at all, and then if so, why not with FortiClient?

    Christopher_McMullan
    Staff
    Christopher_McMullan
    Staff
    January 22, 2015

    Has the client ever been able to successfully connect to the SSLVPN using FortiClient in the past, and/or from some other location?

    cparfon
    cparfonAuthor
    New Member
    January 22, 2015

    Yes. Everywhere outside China. :|

    Christopher_McMullan
    Staff
    Christopher_McMullan
    Staff
    January 22, 2015

    Just that the FortiClient output for the fortissl adapter stands out as odd to me: no dialtone?

     

    Thinking outside the box, I'm wondering if IPsec could get through, or else just using the web portal with a connection tool or bookmarks to access internal resources as one workaround.

     

    Can they get to the web portal at least, or nothing at all through the browser?

    cparfon
    cparfonAuthor
    New Member
    January 22, 2015

    Yeah. They are able to access the FG VPN web portal and connect. But nothing apparently works. 

    Looking at logs when they connect to the portal I can see this:

     

     

    date=2015-01-22 time=13:47:46 logid=0101039424 type=event subtype=vpn level=information vd="root" action="tunnel-up" tunneltype="ssl-web" tunnel_id=179308386 remote_ip=123.116.47.242 tunnel_ip=(null) user="lan.liu" group="vpn_usergroup" dst_host="N/A" reason="login successfully" msg="SSL tunnel established" date=2015-01-22 time=13:47:45 logid=0101039943 type=event subtype=vpn level=information vd="root" action="ssl-new-con" tunneltype="ssl" tunnel_id=0 remote_ip=123.116.47.242 tunnel_ip=(null) user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL new connection"

    sensorsinc
    sensorsincAnswer
    New Member
    January 30, 2015

    China recently "upgraded" their Great Firewall and is actively monitoring and blocking VPNs in real-time.

     

    http://techcrunch.com/2015/01/23/china-vpn-crackdown/

    http://www.wsj.com/articles/chinas-great-firewall-gets-taller-1422607143

     

    There are VPN providers who are actively working around the issue.  Astrill (https://www.astrill.com) for example is supposed to work on everything but iOS.

     

    I just started my search here to see what FortiNet is doing about it. 

     

    If anyone knows of an official response from FortiNET I would like to hear about it.

     

    Good luck!

    Terms & ConditionsAccessibility statement