|
In some cases, after upgrading to FortiOS v7.4, SSL VPN may stop responding to requests when its virtual interface is part of a zone, even if that zone is referenced in a firewall policy. This problem occurs only in configurations where the SSLVPN virtual interface 'ssl.root' is not listed as the first entry in the zone configuration.
The issue has already been resolved in FortiOS v7.6.3 and is documented in the release notes under Engineering Case ID 1126825.
Resolved issues
Observed symptoms:
- SSL VPN Web Mode fails to load its webpage.
- In tunnel mode, FortiClient may report the error 'VPN Server may be unreachable (-14)' during connection attempts.
- No SSL VPN debug logs will be generated, and no corresponding process ID for its daemon will appear in the running processes list.
For the FortiOS v7.4 branch, there are two workarounds available to restore VPN functionality.
Workaround 1:
Remove the SSL VPN virtual interface 'ssl.root' from the zone configuration and reference it directly within the firewall policy.
This requires either referencing multiple interfaces in the source of the existing policy or creating a clone of the policy and modifying the source interface.
Workaround 2:
Update the system zone configuration to ensure that the 'ssl.root' interface appears as the first entry.
The following example shows a zone configuration that causes SSL VPN to stop working in the v7.4 branch:
FG200F-6 # show system zone
config system zone
edit "WANZONE"
set interface "a_vlan" "ssl.root" <<<
next
end
The solution is to edit the zone via CLI, modify it to include only the ssl.root interface, and then commit the changes.
After committing the first change, edit the zone again to re-add the previously included interfaces, ensuring that ssl.root is listed as the first entry.
FG200F-6 # config system zone
FG200F-6 (zone) # edit WANZONE
FG200F-6 (WANZONE) # set interface ssl.root
FG200F-6 (WANZONE) # next
FG200F-6 (zone) # edit WANZONE
FG200F-6 (WANZONE) # set interface ssl.root a_vlan <<<
FG200F-6 (WANZONE) # show
config system zone
edit "WANZONE"
set interface "ssl.root" "a_vlan"
next
end
Following these steps in the same order will place the virtual interface as the first entry in the configuration, allowing SSL VPN to function correctly.
Note: If the zone is used by at least one policy, a reboot of the FortiGate unit is needed in order for the changes to take effect.
Related articles:
Troubleshooting Tip: SSL VPN Troubleshooting
Troubleshooting Tip: Possible reasons for FortiClient SSL VPN connectivity failure at specific perce...
|
