Technical Tip: Troubleshooting PPTP VPN users experiencing disconnections on the FortiGate

[Jonathan_Body_FTNT]

Description

This article describes how to troubleshoot PPTP VPN users experiencing disconnections on the FortiGate.

Scope

All supported versions of FortiOS.

Solution

The following steps can be used to understand why a PPTP VPN user is experiencing disconnections from the FortiGate and to enable the appropriate FortiOS debug depending on the type of PPTP VPN User.

1. A PPTP VPN user connects to the FortiGate with local authentication. If the user disconnects and cannot connect, then connect the PC and enable the following FortiGate debug via the CLI.
   
   

diag deb enable

diag deb reset

diag deb console timestamp en

diag deb app ppp -1

diag deb app pptp -1

diag deb app authd -1

diag deb app fn -1

diag deb en

diag vpn pptp status

2. Collect a sniffer trace on the port of the PPTP connection.
   
   

diag sniffer packet <Interface of pptp connection> 'local_ip_addr of pc' 6

3. If the PPTP VPN User uses authentication with LDAP, enable the following debug with step 1.

diag test auth ldap (ldapservername in GUI) (username to test) (pwd user)

diag test auth ldap LDAP_Server user password

4. If the PPTP VPN User uses RADIUS, collect the following debug output as well.

diag test authserver radius <server_name> <chap | pap | mschap | mschap2> <username> <password>

5. If debugging for an authenticated user needs to be taken again, use the following commands to clear the session.

 

diag deb reset

diag deb console time en

diag deb app fnbamd -1

diag deb enable

6. Compare the debug with the PPTP disconnect message on the PC. A full list of PPTP disconnect messages may be found in this Microsoft support article.

Should the problem persist, open a support ticket via the Fortinet Support Portal at https://support.fortinet.com/. Attach the debug information collected in steps 1-5 to the ticket.