Technical Tip: How to monitor the link health for SSL VPN connections

pgautam · ‎07-12-2023

Description

This article describes that sometimes, there are some issues where some SSL VPNs users report slowness issues. In such cases, there is a dynamic tunnel link monitoring option available from 7.2.0 FortiOS.

Scope

FortiGate, v7.2.x, Link-monitor, Dynamic tunnel.

Solution

Example of the SSL VPN connection:

Configure SSL VPN on FortiGate:

Refer to the below guide for the SSL VPN configuration:-

https://docs.fortinet.com/document/fortigate/7.2.5/administration-guide/371626/ssl-vpn

2. Now configure the ssl.root interface for link-monitor:

config system link-monitor

edit ssl_vpn

set srcintf "ssl.root"

set server-type dynamic

Note:

In this case, server-type is dynamic

For a static server-type link monitor refer to the below link:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Link-monitor/ta-p/197504

3. Connect to the SSL VPN client from the test PC:

Use the below command for the SSL VPN user monitor *

get vpn ssl monitor
SSL-VPN Login Users:
Index User Group Auth Type Timeout Auth-Timeout From HTTP in/out HTTPS in/out Two-factor Auth
0 test123 1(1) 295 27066 10.201.10.240 0/0 0/0 0

Note:
As of FortiOS v7.4.0 and above, user group information can be viewed directly in the SSL VPN monitor in the User Group column. This eliminates the need to navigate to User & Authentication -> User Groups to find group information.

ssl-vpn monitor.PNG

SSL-VPN sessions:

Index User Group Source IP Duration I/O Bytes Tunnel/Dest IP
0 test123 10.201.10.240 1734 215233/151316 10.212.134.200

10.212.134.200 is the SSL VPN IP address assigned from the SSL_VPN subnet pool.
10.201.10.240 is the end machine's public IP.

It is also possible to see the connected user detail from the dashboard SSL-VPN monitor.

Verify the SSL VPN health status:

diagnose sys link-monitor tunnel al

10.212.134.200 (1): state=alive, peer=10.212.134.200, create_time=2023-07-12 12:01:41, srcintf=ssl.root, latency=2.152, jitter=0.535, pktloss=0.000%

In link-monitor SSL VPN assigned IP address 10.212.134.200 will get monitored.

From the above output, it is possible to validate the latency, jitter, and packet loss detail.

Note:

SSL VPN link monitor supports ICMP and IPv4 monitoring protocol.

Make sure that on the test PC ping is not blocked by the endpoint firewall.

The below command can be useful while checking SSL VPN users:

diagnose vpn ssl list

Related documents: