Technical Tip: SSL VPN connected but traffic is not going out from FortiGate

[avp]

Description	This article explains the scenario in which SSL VPN status shows connected, sent-out packets getting increased in the FortiClient Dashboard but proper communication is not happening. While checking from FortiGate, only incoming packets from ssl.root interface are seen. No outgoing packets are seen. FortiGate-120G # diagnose sniffer packet any " host 10.10.23.254 and host 192.168.20.100" 4 0 l interfaces=[any] filters=[ host 10.10.23.254 and host 192.168.20.100] 2025-01-18 16:38:52.222940 ssl.root in 192.168.20.100 -> 10.10.23.254: icmp: echo request 2025-01-18 16:38:52.651925 ssl.root in 192.168.20.100 -> 10.10.23.254: icmp: echo request 2025-01-18 16:38:57.656103 ssl.root in 192.168.20.100 -> 10.10.23.254: icmp: echo request 2025-01-18 16:38:58.718683 ssl.root in 192.168.20.100 -> 10.10.23.254: icmp: echo request Or, FortiGate will send back an ICMP unreachable message to the client's PC: 2025-01-18 17:01:12.944218 ssl.root in 192.168.20.100 -> 10.10.10.254: icmp: echo request 2025-01-18 17:01:12.944235 ssl.root out 172.168.17.1 -> 192.168.20.100: icmp: net 10.10.10.254 unreachable 2025-01-18 17:01:13.621157 ssl.root in 192.168.20.100 -> 10.10.10.254: icmp: echo request 2025-01-18 17:01:18.622133 ssl.root in 192.168.20.100 -> 10.10.10.254: icmp: echo request 2025-01-18 17:01:18.622153 ssl.root out 172.168.17.1 -> 192.168.20.100: icmp: net 10.10.10.254 unreachable 2025-01-18 17:01:19.630179 ssl.root in 192.168.20.100 -> 10.10.10.254: icmp: echo request Where 192.168.20.100 is the SSLVPN user's IP, 10.10.23.254 is the destination IP and 172.168.17.1 is the management interface IP.
Scope	FortiGate.
Solution	Check and verify whether an active policy is available in the firewall for the destination address. A proper route should be configured in FortiGate towards the destination. Even though both routes and policies are verified, there is a chance that the destination interface and ssl.root interfaces are configured in different VRFs:- edit "ssl.root"     set vdom "root"     set vrf 10 <----- Here VRF is set to 10.     set allowaccess ping https     set type tunnel     set alias "SSL VPN interface"     set snmp-index 34 next In this case, all other interfaces are in the default VRF, and ssl.root is in VRF10. This VRF can be unset for ssl.root interface so that all the  source and destination interfaces will be in the same VRF:- config system interface     edit "ssl.root"     unset vrf end This will unset the VRF10 for ssl.root interface and then it will be in the default VRF.  Related article: Technical Tip: Virtual routing and forwarding ID configuration