FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article describes an issue where users are unable to connect to SSL VPN when the ssl.root interface is assigned to a zone.
Scope
FortiGate v7.4.6, v7.4.7, v7.6.2.
Solution
When ssl.root interface is added to a zone, SSL VPN connections fail.
config system zone edit "VPN" set interface "VPN1" "ssl.root" next
SSL VPN debug logs may not display any output at the time of the issue. Additionally, the SSL VPN daemon (sslvpnd) process may be failing to start.
diagnose debug app sslvpnd -1 <----- Debugs do not print any output. diagnose debug enable diagnose sys process pidof sslvpnd <----- Process ID of sslvpnd daemon is not listed.
This issue has been resolved in v7.6.3.
Note:
Starting from v7.6.3, SSL VPN tunnel mode is no longer supported. This applies to all FortiGate models.
