Troubleshooting Tip: SSL VPN Troubleshooting

[jvaishnav]

Description
This article describes how to troubleshoot SSL VPN issue.

Solution
SSL VPN debug command.

Use the following diagnose commands to identify SSL VPN issues.
These commands enable debugging of SSL VPN with a debug level of -1 for detailed results.

# diagnose debug application sslvpn -1
# diagnose debug enable

The CLI displays debug output similar to the following:

[282:root]SSL state:before/accept initialization (172.20.120.12)
[282:root]SSL state:SSLv3 read client hello A (172.20.120.12)
[282:root]SSL state:SSLv3 write server hello A (172.20.120.12)
[282:root]SSL state:SSLv3 write change cipher spec A (172.20.120.12)
[282:root]SSL state:SSLv3 write finished B (172.20.120.12)
[282:root]SSL state:SSLv3 flush data (172.20.120.12)
[282:root]SSL state:SSLv3 read finished A:system lib(172.20.120.12)
[282:root]SSL state:SSLv3 read finished A (172.20.120.12)
[282:root]SSL state:SSL negotiation finished successfully (172.20.120.12)
[282:root]SSL established: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1

To disable the debug.

# diagnose debug disable
# diagnose debug reset

Remote user authentication debug command.

Use the following diagnose commands to identify remote user authentication issues.

# diagnose debug application fnbamd -1
# diagnose debug reset

Troubleshooting common issues.

To troubleshoot getting no response from the SSL VPN URL:

- Go to VPN -> SSL-VPN Settings.
- Check the SSL VPN port assignment.
- Check the restrict access setting to ensure the host connected from is allowed.
- Go to Policy -> IPv4 Policy or Policy -> IPv6 policy.
- Check that the policy for SSL VPN traffic is configured correctly.
- Check the URL to connect to. It follows this pattern: https://<FortiGate IP>:<Port>
- Check the correct port number in the URL is used. Ensure FortiGate is reachable from the computer.
- ping <FortiGate IP>
-Check the browser has TLS 1.1, TLS 1.2, and TLS 1.3 enabled.

To troubleshoot FortiGate connection issues.

- Check the Release Notes to ensure that the FortiClient version is compatible with the  version of FortiOS.
FortiClient uses IE security setting, In IE Internet options -> Advanced -> Security, check that Use TLS 1.1 and Use TLS 1.2 are enabled.
- Check that SSL VPN 'ip-pools' has free IPs to sign out.
The default 'ip-pools' SSLVPN_TUNNEL_ADDR1 has 10 IP addresses.
Export and check FortiClient debug logs.
Go to File -> Settings.
In the Logging section, enable Export logs.
Set the Log Level to Debug and select Clear logs.
Try to connect to the VPN.
When connection error is get, select 'Export logs'.

To troubleshoot SSL VPN hanging or disconnecting at 98%.

A new SSL VPN driver was added to FortiClient 5.6.0 and later to resolve SSL VPN connection issues.
If the FortiOS version is compatible, upgrade to use one of these versions.
Latency or poor network connectivity can cause the login timeout on the FortiGate.
In FortiOS 5.6.0 and later, use the following commands to allow a user to increase the SSL VPN login timeout setting.

# config vpn ssl settings
  set login-timeout 180 (default is 30)
  set dtls-hello-timeout 60 (default is 10)
end

To troubleshoot tunnel mode connections shutting down after a few seconds.

This is happening if there are multiple interfaces connected to the Internet, for example, SD-WAN.
This can cause the session to become 'dirty'.

To allow multiple interfaces to connect, use the following CLI commands.

For version 6.0.1 or later.

# config system interface
  edit <name>
    set preserve-session-route enable
  next
end

For version 6.0.0 or earlier.

# config vpn ssl settings
   set route-source-interface enable
end

To troubleshoot users being assigned to the wrong IP range.

Go to VPN -> SSL-VPN Portals and VPN -> SSL-VPN Settings and ensure the same IP pool is used in both places.
Using the same IP Pool prevents conflicts. If there is a conflict, the portal settings are used.

To troubleshoot slow SSL VPN throughput.

Many factors can contribute to slow throughput.
This recommendation tries to improve throughput by using the FortiOS Datagram Transport Layer Security (DTLS) tunnel option, available in FortiOS 5.4 and above.
DTLS allows SSL VPN to encrypt traffic using TLS and uses UDP as the transport layer instead of TCP. This avoids retransmission problems that can occur with TCP-in-TCP.
FortiClient 5.4.0 to 5.4.3 uses DTLS by default.
FortiClient 5.4.4 and later uses normal TLS, regardless of the DTLS setting on the FortiGate.

To use DTLS with FortiClient.

Go to File -> Settings and enable 'Preferred DTLS Tunnel'
.
To enable DTLS tunnel on FortiGate, use the following CLI commands.

# config vpn ssl settings
  set dtls-tunnel enable
end