Description
This article describes how to resolve VPN connectivity issues in FortiSASE, specifically addressing the 'HttpSendRequest fails with error code 12029' that appears in FortiClient diagnostic output.
Scope
FortiSASE.
Solution
When attempting to connect to the FortiSASE VPN, the connection fails. For local users, it disconnects at 40%, and for SAML users, the SAML login page does not appear.
When collecting FortiClient Diagnostic Output:
C:\Users\sjoshi\Downloads\Diagnostic_Result\FCDiagData\general\current_user_logs\trace
Open sslvpnlib_1 file
[2024-10-21 15:07:25.0883748 UTC+02:00] [2516:5552] [sslvpnlib 5604 info] >>>>DoConnect(turbo-e8lycd1m.edge.prod.fortisase.com:443) ...
[2024-10-21 15:07:25.0884027 UTC+02:00] [2516:5552] [sslvpnlib 2121 info] Called. Server=turbo-e8lycd1m.edge.prod.fortisase.com, realm=, username=.
[2024-10-21 15:07:25.0884374 UTC+02:00] [2516:5552] [sslvpnlib 4903 debug] called.
[2024-10-21 15:07:25.0884547 UTC+02:00] [2516:5552] [sslvpnlib 4906 debug] FortiSslvpn has been initialized, exit.
[2024-10-21 15:07:25.2478956 UTC+02:00] [2516:5552] [sslvpnlib 1144 info] GetWebPage(): URL=/remote/info -->
[2024-10-21 15:07:25.2485027 UTC+02:00] [2516:5552] [sslvpnlib 1382 debug] FGT Does not need EMS SN
[2024-10-21 15:07:25.6974804 UTC+02:00] [2516:5552] [sslvpnlib 1563 error] 1563 HttpSendRequest() bReqResult=0,lpTarget=/remote/info,Retry=0,LastError=12029
[2024-10-21 15:07:25.6975313 UTC+02:00] [2516:5552] [sslvpnlib 1152 info] ====================================
[2024-10-21 15:07:25.6975497 UTC+02:00] [2516:5552] [sslvpnlib 1153 info]
[2024-10-21 15:07:25.6975656 UTC+02:00] [2516:5552] [sslvpnlib 1154 info] ====================================
[2024-10-21 15:07:25.6975827 UTC+02:00] [2516:5552] [sslvpnlib 1158 error] GetWebPage() failed. bRC=0,strContentType=,strPageLength=0
[2024-10-21 15:07:25.6976000 UTC+02:00] [2516:5552] [sslvpnlib 2540 error] 2540 GetWebPageEx failed. strInfoXmlUrl=/remote/info
[2024-10-21 15:07:25.6981738 UTC+02:00] [2516:5552] [sslvpnlib 1382 debug] FGT Does not need EMS SN
[2024-10-21 15:07:26.0942858 UTC+02:00] [2516:5552] [sslvpnlib 2737 error] Request /remote/saml/login failed. LastError:12029
This issue arises when the PC with FortiClient installed fails to connect to the SASE VPN because it is not configured to use the TLS 1.2 or 1.3 protocols. The hosted site has disabled support for TLS 1.0 and 1.1 due to security risks, as these versions are nearing end-of-life and many hosting sites are phasing them out. Error '12029' is a WinHTTP error code indicating that the socket connection failed because encrypted communication could not be established.
Testing from another PC with TLS 1.2 and TLS 1.3 enabled successfully establishes the VPN connection.
Related document:
Diagnostic Tool
