| Description | This article describes how to collect, analyze, and interpret logs from FortiClient, with a particular focus on scenarios involving Pre-Logon VPN and connections using FortiSASE Secure Internet Access (SIA). |
| Scope | FortiClient, FortiSASE, FortiGate: |
| Solution |
VPN disconnections can be identified and troubleshooted by analyzing relevant log entries. Common error messages and alerts indicate the potential root causes and corresponding corrective actions.
In this article, the VPN connection occurs in two distinct stages:
When the system starts, a Pre-Logon VPN is established to the on-prem FortiGate firewall through a client certificate. This allows access to the domain controller, policy synchronization, and group policy update. After user authentication, the VPN connection transitions automatically to Secure Internet Access (SIA), which operates under FortiSASE.
For troubleshooting pre-logon VPN issues, both FortiGate logs and FortiClient logs can be utilized. On the FortiGate, the following commands are used to capture SSL VPN debug logs:
diagnose vpn ssl debug-filter src-addr4 x.x.x.x (source public IP address)
If the pre-logon VPN connection is successful, the FortiGate logs typically include the entry: 'add auth logon for user SASE Pre-Logon'. Additionally, the connected users can be verified under 'Firewall User Monitor' on the FortiGate dashboard.
On the FortiClient side, the 'Remote Access' tab should be reviewed to confirm whether the transition from pre-logon VPN to Secure Internet Access (SIA) VPN occurred automatically. The transition is expected to happen without user intervention, but in some cases, the process may fail. When the automatic switch does not occur, the FortiGate SSL VPN debug logs, as well as FortiClient logs, should be examined for further troubleshooting.
FortiClient logs can be collected both with and without generating diagnostic logs:
C:\Program Files\Fortinet\FortiClient\logs\trace C:\Users [Logged-In User]\AppData\Roaming\FortiClient\logs\trace
Among all the log files in this folder, the following log files are most relevant for VPN troubleshooting:
In the table below, a summary is provided of which logs to check for troubleshooting specific issues:
Note: All registry information is inside the diagnostic logs, which can be accessed through the following path:
Diagnostic Logs -> FCDiagData -> General:
Note: When SAML authentication is configured, the SamlAuthwb log provides insight into SAML request and response handling. This file is particularly useful when errors such as 'cannot find …' appear during SAML authentication. This log indicates how the SAML request was sent and how the response was received. In fact, this is where the back-and-forth exchange between the SAML request and response with the IDP takes place.
Path: C:\users\logged-in user\appdata\roaming\forticlient\logs\trace.
Example Scenario: During VPN disconnection troubleshooting, enable the SSL VPN debug log on the FortiGate before the system boots up. Once the Pre-Logon VPN connection is established, verify user presence in the User Monitor section on FortiGate. Then, confirm whether the switch from Pre-Logon VPN to Secure Internet Access (SIA) VPN occurred successfully on FortiClient.
In the following, the common keywords that could be used in different logs to perform troubleshooting are listed:
These keywords assist in identifying timestamps and correlating events with specific disconnection patterns or error conditions.
Summary of Key States for Successful Prelogon and SIA VPN Connections: For Prelogon:
For SIA:
By locating the relevant logs and searching for the appropriate keywords within them, the troubleshooting process can be initiated effectively. Log entries before and after these keywords typically contain valuable data for identifying the root cause and determining corrective actions. |
