Description
This article provides a solution if the SSL VPN connection fails due to policy denial.
No logs on the debug command related to SSL VPN are found during the issue.
diagnose debug reset
diagnose debug app sslvpn -1
diagnose debug en
To Stop the Debugs:
diagnose debug disable
diagnose debug reset
Scope
FortiGate.
Solution
Run a debug command to check the SSL VPN traffic.
diagnose debug reset
diagnose debug flow sh fu en
diagnose debug flow filter addr <IP of sslvpn>
diagnose debug flow trace start 100
diagnose debug en
To stop the debugs:
diagnose debug disable
diagnose debug reset
Getting error on policy deny as below:
id=20085 trace_id=1273 func=fw_local_in_handler line=410 msg="iprope_in_check() check failed on policy 0, drop"
Create a specific policy from the source interface where the connection is initiated to the Loopback interface.
Go to Policy & Object -> IPv4 policy/Firewall policy and 'Create New'.
After the policy is created, the user can connect to an SSL VPN.
Note:
- For models with 2GB or less RAM, SSL VPN web and tunnel mode are removed from the GUI and CLI in v7.6 and later, check: SSL VPN to dial-up VPN migration
- The SSL VPN tunnel mode feature will no longer be available starting from v7.6.3: SSL VPN tunnel mode no longer supported
