Technical Tip: How to check TLS Version used by FortiClient machine when trying to connect to FortiGate using SSL VPN

[jlim11]

Description	This article describes how to check the TLS version negotiated by a client machine trying to connect to an SSL VPN using FortiClient. Some FortiClient machines may experience the following error below when trying to connect: It indicates that the TLS version between the client and FortiGate does not match. Even running the debug for SSL VPN on the FortiGate, will show an 'unsupported protocol' for the connection that the client machine is trying to initiate. The default minimum TLS version on the FortiGate to accept SSL VPN connections is tls1.2:
Scope	FortiGate.
Solution	To check the TLS version negotiated by the client machine, Perform packet capture on FortiGate's external interface where it accepts SSLVPN connections From GUI: Go to Network -> Packet Capture and select 'Create new'. Filter the interface and the port used by SSL VPN. Run the packet capture then initiate the connection from the FortiClient. Stop the debug then download the .pcap file Open the .pcap file using the Wireshark application Look for the TLS Client hello with the source IP(Public IP in most cases) of the FortiClient machine after the TCP three-way handshake. Select the TLS Client Hello, Then expand the 'Transport Layer Security' The TLS version is shown after. It is possible to filter TLS client hello on Wireshark using the following: _ws.col.info == "Client Hello" or tls On the windows machines, It is possible to check the available TLS versions that the machine will use to negotiate, Open 'Internet Options' and then the 'Advance' tab: Related articles: How to control the SSL version and cipher... - Fortinet Community Technical Tip: The use of TLS 1.3 Protocol on Wind... - Fortinet Community

-