SSL VPN Slow on Domain Login

Hello SLG,

I have found this document which explains how to troubleshoot some issues:

https://docs.fortinet.com/document/fortigate/7.2.0/administration-guide/993282/troubleshooting-common-issues

Could you please telle me if it helps?

Regards,

 Hi Anthony,

Thank you for your reply - I have looked through all the troubleshooting but it doesnt seem to be an issue with the tunnel  itself as it works fine when I am logged in as a non domain user to the computer,

Thanks,

Sara

Hello,

We are still looking for an answer to your question.

We will come back to you as soon as we get it.

Regards,

Hi SLG,

Interesting issue. To recap. The difference is the end user logging in as local user or domain user, in both cases no connectivity is given towards the domain controller.

What exactly is slow?

- The logon process?

- The general VPN connection after login?

Doesn't sound like it, but any better with a LAN cable, instead of using wireless? With the description I would not think so, but well, wireless can be flaky.

GPO might really be something, it depends on the GPO is for some reason changing the FortiClients' configuration, for example, the domain user has DTLS enabled, the local user has it disabled (or simply the tunnel settings are different).

Best regards,

Markus

Steps to fix SSL VPN Slow on Domain Login-

Verify the user's portal accessibility
Ensure that the SSL VPN service is selected for the >WAN interface under Administration > Device access.Verify the admin port settings
Ensure the SSL VPN users access the portal using the port configured under Administration > Admin and user settings > Admin console and end-user interaction.

Ports.PNG

Verify the certificate
Make sure that the proper certificate is associated with the SSL VPN user. Using the appliance certificate and regenerate the certificate if required is recommended. For more information, go to Sophos Firewall: Self-signed certificates are not supported.

Verify the logs from the GUI
Go to Log viewer and filter the Log comp to SSL VPN.

Filter.PNG

Verify the SSL VPN traffic flow from the console
Sign in to the command-line interface (CLI) and select 4: Device Console. Run the following command, which uses the default SSL VPN port 8443, to analyze the output.

tcpdump "port 8443"

tidy_fix_alt

Verify the logs from the advance shell
Sign in to the command-line interface (CLI) and select 5: Device Management, then 3: Advanced Shell, and run the following command:

tail -f /log/sslvpn.log

tidy_fix_alt

Verify the logs from SSL VPN Client
Right-click the SSL VPN Client on the taskbar of your computer and select View Log.

Verify the user has a proper SSL VPN remote access policy assigned
Go to Authentication > Users and confirm that the SSL VPN user has two or more simultaneous logins allowed under SSL VPN policy, in case the user is simultaneously logged in from a different device at the same time.

Simultaneous.PNG

Verify the SSL VPN authentication method
When receiving Auth-failure error messages in logs, verify the authentication method under Authentication > Services > SSL VPN authentication methods.

Greeting,

Rachel Gomez