|
To troubleshoot SSL VPN authentication issues where connections drop instantly after authentication, recommend to perform the following steps:
- Collect FortiClient and EMS Debug Logs. Gather detailed logs during connection attempts (success and failure), including timestamps. Test with FortiClient 7.2.x using SAML authentication, both with Telemetry enabled and disabled.
- Run Debug commands on the FortiGate.
diagnose debug reset
diagnose debug console timestamp enable
diagnose vpn ssl debug-filter src-addr4 <client public IP>
diagnose debug application sslvpn -1
diagnose debug application samld -1
diagnose debug application fnbamd -1
diagnose debug enable
- Validate EMS Details. Check the EMS serial number and version associated with the customer to ensure compatibility. Confirm whether the issue affects local users as well, or whether they can be excluded from the scope.
- Verify SAML Configuration. Inspect the group-name attribute in the SAML configuration. Ensure it matches the attribute used by the Identity Provider (IdP). Mismatched SAML attributes commonly lead to failed or unstable connections.
- Endpoint-Level Checks. Perform the following validations on affected endpoints:
1. Install the latest Microsoft VC++ Redistributable.
2. Disable IPv6 on the network interface used for SSL VPN connections.
These steps help avoid known interoperability issues.
- Update EMS XML Configuration. Clone the existing EMS profile and modify to include the following changes.
- Configure the following values as recommended:
resolve_to_ipv4_only=1
keep_fqdn_resolution_consistency=1
These options help stabilize DNS and FQDN behavior during VPN tunnel establishment.
- Enable DTLS.
- Update SSL/DTLS MTU values.
- SSL MTU = 1100.
- DTLS MTU = 1300.
- Set DNS cache control to 2.
Assign the modified EMS profiles to the test endpoints and test the VPN connection.
Related documents:
|
