This article describes how to control the SSL and TLS versions used by the FortiClient when connecting to SSL VPN.Scope
FortiClient - All versions.Solution
FortiClient uses the Internet Explorer SSL and TLS settings to initiate the SSL connection.
The versions used can be disabled and enabled by navigating to the following option on Internet Explorer:
Internet options > Advanced > SecurityThe options are shown in the following screenshot:
Using the FortiGate CLI the same options can be selected as follows:
#config vpn ssl settings Verification of Configuration and troubleshooting
set sslv3 disable
set tlsv1-0 disable
set tlsv1-1 enable
set tlsv1-2 enable
If there is a version mismatch, the connection would be seen to be terminating with no definite error in the SSL VPN debugs.
Packet captures would show the versions that are incoming.