Troubleshooting Tip: Why SSL VPN connectivity fails at 10%

[rsondal]

Description	This article describes why SSL VPN fails at 10% due to an issue with the network connection to the FortiGate.
Scope	FortiGate.
Solution	If the SSL VPN is behind NAT, it will fail at 10%. For this issue, it is necessary to do a port forwarding rule for the SSL VPN port and point it to the FortiGate WAN interface IP on the ISP modem. See Technical Tip: SSL VPN behind NAT for more information on this. Make sure that internet connectivity is working on the remote user's end: Make sure to be able to telnet the SSL VPN server IP on the SSL VPN port on the remote system. Make sure that the SSL VPN configuration on FortiClient is correct: Make sure the external public IP is not getting denied by the firewall locally in the policy. Check the screenshot below for how to locate the local in policy on FortiGate: Make sure to use the server certificate in SSL VPN settings in FortiGate: Make sure that there is a firewall policy with an Interface and an SSL VPN tunnel interface: Make sure there is no open VIP for all the ports on the firewall with the same external IP, and also no VIP with a forward port to the same SSL VPN port: Sometimes, if a source address is defined in the SSL VPN settings and the Source negate option is enabled in the VPN setting on the CLI, then the process will also fail at 10%. Disabling source-address-negate will make it pass this 10% fail error. config vpn ssl setting     set source-address-negate disable end Make sure the setting 'Restrict access' is set to 'Allow access from any host'. If it is set to 'Limit access to specific host', make sure the client's public IP is allowed. If FortiGate is operating in NGFW policy-based mode and no SSL VPN process is found when running 'diagnose sys tcpsock | grep ssl', the issue could be with a missing SSL Inspection & Authentication policy as per the following article: Technical Tip: SSL VPN is not working when FortiGate is on NGFW Policy-based. Make sure that the SSL VPN is enabled.   If the remote gateway is a DDNS domain, ensure that the hostname is being resolved to the correct public IP. Check it using nslookup via Command Prompt. If the DDNS configured in the FortiGate resolves to the firewall's old public IP, which has been updated already, refer to this KB article: Troubleshooting Tip: FortiGuard DDNS IP update fails. If the virtual interface (for example, ssl.root when SSL VPN is configured on the root VDOM) is down, users will experience connectivity failures. Ensure that the virtual interface status is set to 'up'. This setting is visible in the CLI, and by default, the status is 'up'. config system interface     edit "ssl.root"          set vdom "root"         set status down         set type tunnel         set alias "SSL VPN interface"         set snmp-index 14     next end All these reasons can cause SSL VPN to fail at 10%. Make sure all these are correct, and if it still does not work, feel free to open a TAC support case if it requires any further help. Related article:  Troubleshooting Tip: SSL VPN Troubleshooting