Authentication failure on SSL-VPN

[drabbert]

Hi, I' m trying to setup a SSL-VPN to my FortiWifi 60D and get a loging failure when I' m try to login. The logging says: Administrator Erwin login failed from https(.....) because of invalid user name So it seems that I' m trying to connect to the Admin page with my VPN user. Could someone help me on this and tell me how I should connect the SSL-VPN portal? Thanks.

[drabbert]

I' m running FWF60D-5.00-build228. The set source-interface command is not there: FWF60D4613015523 (settings) # set s sslvpn-enable Enable/disable SSL-VPN. sslv2 Enable/disable allow SSLv2. sslv3 Enable/disable allow SSLv3. servercert Server certificate. Probably it works differently in this version.

[emnoc]

Did you check if ssl vpn was enable? ( the first line in your output ) config vpn ssl settings set sslvpn-enable enable <------ here set sslv3 enable or get vpn ssl settings sslvpn-enable : enable sslv3 : enable dns-server1 : 0.0.0.0 dns-server2 : 0.0.0.0 route-source-interface: disable reqclientcert : disable sslv2 : disable force-two-factor-auth: disable force-utf8-login : disable servercert : self-sign algorithm : default idle-timeout : 300 auth-timeout : 28800 tunnel-ip-pools: == [ SSLVPN-P-TUN-0 ] name: SSLVPN-P-TUN-0 portal-heading : (null) wins-server1 : 0.0.0.0 wins-server2 : 0.0.0.0 url-obscuration : disable http-compression : disable

[drabbert]

ssl seems to be enabled, could there be a problem with a policy or interface setting? FWF60D4613015523 # get vpn ssl settings sslvpn-enable : enable sslv3 : enable tlsv1-0 : enable tlsv1-1 : enable tlsv1-2 : enable dns-server1 : 8.8.8.8 dns-server2 : 0.0.0.0 route-source-interface: disable reqclientcert : disable sslv2 : disable allow-ssl-big-buffer: disable allow-ssl-insert-empty-fragment: enable allow-ssl-client-renegotiation: disable force-two-factor-auth: disable force-utf8-login : disable servercert : self-sign algorithm : default idle-timeout : 300 auth-timeout : 28800 tunnel-ip-pools: == [ SSLVPN_TUNNEL_ADDR1 ] name: SSLVPN_TUNNEL_ADDR1 tunnel-ipv6-pools: dns-suffix : wins-server1 : 0.0.0.0 wins-server2 : 0.0.0.0 ipv6-dns-server1 : :: ipv6-dns-server2 : :: ipv6-wins-server1 : :: ipv6-wins-server2 : :: url-obscuration : disable http-compression : disable http-only-cookie : enable port : 443 port-precedence : enable auto-tunnel-static-route: enable auto-tunnel-policy : enable

[emnoc]

yes the diag debug flow is your friend and so is diag sniffer packet. fwiw: Make sure no upstream filters are blocking you. Also diag debug app sslvpn -1 if you see no request or movement with any of the above, than I would suspect something is broken or admist. Based on the output received will steer you to the next step(s) in your t-shoot process.

[drabbert]

I' m lost, I can see the traffic coming in with the sniffer command, but no response from the fortinet. All the debug command don' t give any output. I' ll ask my supplier on Monday... Thanks for all your help

[drabbert]

I' ve upgraded to 5.2, bind the interface and now it' s working. Thanks!