6.0.9 Unable to Receive SSL VPN Tunnel IP Address

[bdavies]

Have about 25 users with SSL VPN using FortiClient. Tunnel addressing is a /24 network, so lots of addresses available in the pool. They intermittently get errors when connecting Unable to Receive SSL VPN Tunnel IP Address(-30). I have a case open, wondering if anyone else has solved this. I will report back with support's answer. FortiGate 100D, Firmware 6.0.9. Might try 6.2 if this goes on much longer. I ran some debugs of SSLVPN and DHCP, didn't turn anything interesting up. We do not have VDOMs configured. 

[bdavies]

Heard back from support. In SSL VPN Settings, we had a /24 network defined, but in the portal for this user group, there was a much narrower band of addresses defined. We don't use web mode, but this setting still applied when connecting with FortiClient.