Description
This article explains why the SSL VPN authentication failure logs with tunnel-type web still happen after removing the SSL VPN authentication page as per the article below:
Technical Tip: How to prevent the SSL VPN web login portal from displaying when SSL VPN web mode is ...
Scope
FortiGate.
Solution
Every authentication failure on the FortiGate will be categorized as web for the tunnel type even if the attempt came from a FortiClient.
Log for failed FortiClient authentication:
Log for failed Web Mode authentication:
Log for successful FortiClient authentication:
Log for successful Web mode authentication:
This is due to FortiClient identifying itself to be accessing the tunnel mode after the authentication attempt and as a result, FortiGate cannot detect tunnel mode versus web mode on authentication failure:
Successful FortiClient authentication debugs:
[15510:root:a]sslvpn_authenticate_user:183 authenticate user: [test-fct]
[15510:root:a]sslvpn_authenticate_user:197 create fam state
[15510:root:a][fam_auth_send_req_internal:426] Groups sent to FNBAM:
[15510:root:a]group_desc[0].grpname = test
[15510:root:a][fam_auth_send_req_internal:438] FNBAM opt = 0X200420
[15510:root:a]fam_auth_send_req_internal:514 fnbam_auth return: 0
[15510:root:a][fam_auth_send_req_internal:539] Authenticated groups (1) by FNBAM with auth_type (1):
[15510:root:a]Received: auth_rsp_data.grp_list[0] = 2
[15510:root:a]fam_auth_send_req_internal:563 found node test:0:, valid:1, auth:0
[15510:root:a]Validated: auth_rsp_data.grp_list[0] = test
[15510:root:a][fam_auth_send_req_internal:652] The user test-fct is authenticated.
[15510:root:a]fam_do_cb:666 fnbamd return auth success.
…. (omitted for brevity)
[15511:root:a]normal tunnel2 request received.<----- Tunnel mode initiated.
[15511:root:a]sslvpn_tunnel2_handler,166, fct_uuid = 86D85EDFFC3E422F8619956B74CE508E<----- Identifying the FortiClient.
[15511:root:a]sslvpn_tunnel2_handler,174, Calling tunnel2 DESKTOP-8PB5B98.
Failed FortiClient authentication debugs:
[15514:root:a]sslvpn_authenticate_user:183 authenticate user: [fct-failed]
[15514:root:a]sslvpn_authenticate_user:197 create fam state
[15514:root:a][fam_auth_send_req_internal:426] Groups sent to FNBAM:
[15514:root:a]group_desc[0].grpname = test
[15514:root:a][fam_auth_send_req_internal:438] FNBAM opt = 0X200421
[15514:root:a]fam_auth_send_req_internal:514 fnbam_auth return: 1
[15514:root:a][fam_auth_send_req_internal:539] Authenticated groups (1) by FNBAM with auth_type (1):
[15514:root:a]Received: auth_rsp_data.grp_list[0] = 0
[15514:root:a]fam_auth_send_req:1007 task finished with 1
[15514:root:a]login_failed:392 user[fct-failed],auth_type=1 failed [sslvpn_login_permission_denied]
[15514:root:0]dump_one_blocklist:94 status=1;host=172.17.98.14;fails=1;logintime=1721862179
…… (end here, no further debugs)
Therefore, after hiding the SSL VPN login page (on v 7.4.1 and below) or disabling it globally (v7.4.2 and above), it is expected to see every failed authentication for SSL VPN flagged with 'tunnel Type ssl-web'. The log does not mean an authentication attempt is being pushed through the SSL VPN login page.
