■Equipment Information
model number:FG-60F-FW-US
version:v7.2.5
■Questions
Use ssl-vpn in tunnel mode.
Authentication methods are client certificate, ID and password.
9 PKI users were created.
The client certificate is a file common to all users.
However, when I try to connect from FortiClient(Windows10), only one particular user can connect to the VPN. If I try to connect with the rest of the users, the connection fails.
I would like to know about the cause. Thank you in advance.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello @kazuki ,
- Can we know at what percentage it is failing?
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Possible-reasons-for-FortiClient-SSL...
or if you can get debugs while connecting that will also help why it is failing
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-Troubleshooting/ta-p/189542
Created on 12-06-2023 05:40 PM Edited on 12-06-2023 11:23 PM
Ignore this sentence.
Created on 12-06-2023 09:05 PM Edited on 12-06-2023 11:23 PM
Ignore this sentence.
Hello @dbhavsar
Thanks for the reply.
At 48%, I get an error message.
The error message is as follows.
"VPN connection cannot be established, VPN server may not be reachable (0)"
Hi @kazuki
please try to disable TLS 1.0 / 1.1 in internet options, if that does not helps please collect the following debugs and open up a ticket with TAC:
diagnose debug application sslvpn -1
diagnose debug application fnbamd -1
diagnose debug console timestamp enable
diagnose debug enable
Hey kazuki,
if it fails at 48%, that usually indicates the FortiGate/remote authentication server doesn't like a second factor (FortiToken prompt and check happen at 45 and 48% for example), in your case the certificate.
If it only works for one user out of nine - does it only work for one user at a time, and all other eight will fail while that user is connected, but can connect later, or does it only work for one particular user, and all other users fail all the time?
-> if only one user can connect at a time (no matter which user) this sounds like a limitation in concurrent logins; perhaps because the same user certificate is used, FortiGate considers each connection as the same PKI user and enforces a limit?
-> if only one particular user can connect, and the other eight will always fail, this sounds as if the certificate is only accepted for that user, perhaps because the subject matches that username, or the certificate is associated with that particular user in another way?
As dbhavsar suggested, a TAC ticket might provide some clarity :)
Created on 12-07-2023 05:55 PM Edited on 12-07-2023 05:58 PM
Hi @Debbie_FTNT
Thanks for the reply.
If it only works for one user out of nine - does it only work for one user at a time, and all other eight will fail while that user is connected, but can connect later, or does it only work for one particular user, and all other users fail all the time?
→all other users fail all the time.
-> if only one user can connect at a time (no matter which user) this sounds like a limitation in concurrent logins; perhaps because the same user certificate is used, FortiGate considers each connection as the same PKI user and enforces a limit?
-> if only one particular user can connect, and the other eight will always fail, this sounds as if the certificate is only accepted for that user, perhaps because the subject matches that username, or the certificate is associated with that particular user in another way?
→I understand that Foritigate requires user certificates for the number of PKI users.
I would like to make an additional confirmation,
Is it possible to use the default server certificate (Fortinet_Factory) for client certificate authentication?I am using the default server certificate, is this irrelevant to this case?
Hey kazuki,
technically, if you make a PKI user vague enough, it can match more than one user. The 'subject' value in a PKI user is a substring match, so if you take a part of the subject all users have in common (like a department name or similar) and filter on that, all users would match the PKI user and should be allowed that way.
As for using the default server certificate for client certificate authentication - IF the FortiGate acts as client, it could in theory (probably) utilize the Fortinet Factory certificate. However, the certificate's private key cannot be exported (only the certificate itself), meaning no other device can use it, as using a certificate for authentication requires possession of the private key.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1702 | |
1092 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.