Technical Tip: Credential or SSL-VPN configuration is wrong (-7200) Radius user

[Anonymous]

Description	This article describes how to troubleshoot the RADIUS issue for SSL VPN.
Scope	FortiGate
Solution	SSL VPN tunnel mode is enabled in the firewall and the radius users are imported to the FortiGate. It is necessary to make sure the actual RADIUS user name and the user imported in the FortiGate are the same. If not, a ' credential or ssl vpn configuration is wrong (-7200)' error will be received. See the output below: config user local     edit "test"   <----- Name of the user in firewall.         set status enable         set type radius Since the username in the firewall and radius is the same authentication is successful and two factors worked. Post entering the Token. It worked. By mistake, if the radius user is saved with a different user name then VPN will not work. config user local     edit "Test"  <----- The name from test to Test has been changed.         set status enable         set type radius Trying to connect the VPN but it is not working. It is because of the case sensitive, and post making the below mentioned changes the VPN is connected. Note: This option is only available when two-factor authentication is enabled for the user. config user local     edit "Test"         set status enable         set type radius         set username-case-sensitivity <----- To disable it, use 'set username-case-sensitivity disable'. end Note: As of FortiOS 7.0.1 and above, the syntax of the command has been changed to 'username-sensitivity'. In order to see what is going wrong with the SSL VPN, take the following debug:    diagnose debug reset    diagnose vpn ssl debug-filter src-addr4 x.x.x.x    diagnose debug application sslvpn -1    diagnose debug application fnbamd -1    diagnose debug enable To clear the filter, enter the following commands:    diagnose vpn ssl debug-filter clear To stop the debug, enter the following commands:    diagnose debug disable    diagnose debug reset