Troubleshooting Tip: Why SSL VPN connectivity fails at 10%

[rsondal]

Description	This article describes why SSL VPN fails at 10% due to an issue with network connection to the FortiGate.
Scope	FortiGate.
Solution	If the SSL VPN is behind NAT it will fail at 10%. For this issue, it is necessary to do a port forwarding rule for the SSL VPN port and point it to the FortiGate WAN interface IP on the ISP modem. See Technical Tip: SSL VPN behind NAT for more information on this. Make sure that internet connectivity is working on the remote user end: Make sure to be able to telnet the SSL VPN server IP on the SSL VPN port on the remote system. Make sure that the SSL VPN configuration on FortiClient is correct: Make sure the external public IP is not getting denied by the firewall local in the policy. Check the below screenshot for how to locate local in policy on FortiGate: Make sure to use the server certificate in SSL VPN settings in FortiGate: Make sure that there is a firewall policy with Interface an SSL VPN tunnel interface: Make sure there is no open VIP for all the ports on the firewall with the same external IP and also no VIP with a forward port to the same SSL VPN port: Sometimes, if a source address is defined in the SSL VPN settings and the Source negate option is enabled in the VPN setting on CLI, then the process will also fail at 10%. Disabling source-address-negate will make it pass this 10% fail error.   config vpn ssl setting       set source-address-negate disable   end Make sure the setting 'Restrict access' is set to 'Allow access from any host'. If it is set to 'Limit access to specific host', make sure the client's public IP is allowed. If FortiGate is operating in NGFW policy-based mode and no SSL VPN process is found when running 'diag sys tcpsock | grep ssl', the issue could be with missing SSL Inspection & Authentication policy as per the following article: Technical Tip: SSL VPN is not working when FortiGate is on NGFW Policy-based. Make sure that the SSL VPN is enabled.   If the remote gateway is a DDNS domain, ensure that the hostname is being resolved to the correct public IP. Check it using nslookup via Command Prompt. If the DDNS configured in the FortiGate resolves to the firewall's old public IP which has been updated already, refer to this KB article: Troubleshooting Tip: FortiGuard DDNS IP update fails. All these reasons can cause SSL VPN to fail at 10%. Make sure all these are correct and if still does not work, feel free to open a TAC support case if require any further help.