VPN ssl Tunnel stopped working

Forum|Forum|5 years ago
March 18, 2021
4 replies
5034 views

Hi all, I'm new to Fortinet and this position. But last week we change our IP from our site to the county(I work at a school district). But I just noticed the VPN stopped working. I dont know where to start. Any give me any advice? I cant ping our gateway but not sure if that is normal, from inside? But the error we are getting is that the VPN server may be unavailable. Any help is greatly appreciated.

vpn.png

emnoc

New Member

Explain what you mean by change ip? What I would do is point a browser at the fortigate and the new ip.v4 address and whatever port? Do you get a login screen ?

Next , can you ping the interface assuming ping is allowed?

if both of teh above fails, do a diag packet capture diag debug packet <interface_name> 'port 8443' and test browser or fclient , do you see packets arriving and with the new sslvpn ip.v4 address?

Ken Felix

jesse_garciaAuthor

New Member

Sorry, We had to change our IP given to us from the county. Since we changed from Spectrum to Frontier. This is the WAN IP in the interfaces section of the Network Tab. We changed it there and the static ip to 0.0.0.0. Basically moved us from Spectrum to Frontier. From what i have been told, this just changed the gateway between us and the county's gateway. None of our public IP pools changed.

No i do not get a login page when I point the address to the browser. That gives me the same error. the sit cannot be reached.

Yes I can Ping the address though.

Thanks for you help in this.

emnoc

New Member

Not following you, but is the interface that your pinging protected by a uplink router? firewall?

Do you have any local-in policy that's attached?

Did you run "diag debug flow"

e.g

diag debug reset

diag debug en

diag debug flow filter addr 1.1.1.1 #< this would be your address of the sslvpn interface

diag debug flow trace start 30

Now run your fclient to 1.1.1.1 or whatever ip address? Do you see traffic? if not, you have issues upstream , routing, filtering,etc.....

if you see traffic , than clear the above diag debug and debug sslvpnd

e.g

diag debug reset

diag debug app sslvpnd -1

And repeat the same test and follow the output and|or post it here.

Ken Felix

Sign up

Login with SSO

Login to the community

Login with SSO