Description
This article describes how to perform an SSL VPN debug specific to a Point of Presence (PoP) in FortiSASE.
Scope
FortiSASE.
Solution
In FortiSASE, customer access to backend devices is limited, which restricts advanced troubleshooting capabilities. However, with the help of the 'FortiGate Support Tool,' some debugging tasks can still be performed. This guide focuses on SSL VPN debugging.
Prerequisite.
- Access to the FortiSASE portal.
- Chrome browser.
- Extension for the 'Fortigate Support Tool'.
Step 1:
Obtain the Turbo URL associated with the account. There are several ways to retrieve this URL:
- From the customer's FortiClient (FCT).
-
Through the SASE Portal: navigate to Configuration -> Endpoints -> Profile -> Default.
-
By referring to this article: Technical Tip: How to select a specific POP for a FortiSASE VPN connection.
After obtaining the Turbo URL, perform an 'nslookup' on the client PC to get the CNAME, which indicates the specific PoP.
In the test case, the Turbo URL resolved to the Dubai PoP (referring SWG setting below in FortiSASE). Alternatively, it is also possible to refer to the VPN event logs for further verification.
Step 2:
Log in to the FortiSASE portal, where it will show that the 'FortiGate Support Tool' option is active.
By default, the leader PoP name will be visible. Select 'New Capture' to proceed.
Here, it is necessary to add the preferred PoP and enable Daemon logging for 'sslvpnd'. Then, select 'Start Capture'. Perform the SSL VPN connection attempt from the client PC and wait for the connection to complete or for an error to be displayed.
Afterward, stop the capture. The file will then be downloaded to the local PC.
Note: Debug will be running on both PoPs (leader PoP is selected by default) and there is no source IP filtering for the user's public IP.
Next, select the 'FortiGate Support Tool' extension and select 'View Existing Capture'. Choose the file that was downloaded.
Once uploaded, there will be the option to select the PoP and view the debug logs, which will assist in further troubleshooting.
Related documents:
