FortiClient Permission Denied -455

[marsmatt]

Hey Guys, 

Hoping someone can shed some light on this problem I'm having, Google hasn't been much help unfortunately. 

I've set up an SSL-tunnel VPN for users to connect to our network remotely. Everything seems OK for most users, except for 2 of them. Two users receive [style="background-color: #ffff00;"]"Permission Denied -455"[/style] error message when attempting to connect to the VPN with FortiClient. Users credentials are getting checked against an LDAP connection which I know works because other users are having no issues and I've tried their accounts locally inside the network with my FortiClient. Users are also able to login normally when using domain workstations.

Is this more likely a problem with FortiClient or perhaps their home network? I'm currently working on troubleshooting with the users about their home networks, block ports, router configuration, etc...

FortiGate 800C

Firmware 5.2.4 build 688

Thanks for any insight guys.

Cheers,

/Matt

[Chandra_Ayyagari]

I have a similar issue with the Forti Client. I tried it at both home and work network but result is same. The funny thing is I was able to use this until last week. Not sure what changed over the weekend.

thanks.

[onyangoliech]

Hi Matt,

Having the same issue...how did you fix it. The local user works but not the RADIUS authenticated ones. 

[Abraham1]

Hi,

One year late... Check if you got an address or a local user with the same name as domain username. In my case I had an address with the same name as LDAP user. It was solved after removing it.

[adeluna2005]

I have the same issue and I have no conflicts because of the names, and i still can not connect using SSL and LDAP users. Just Locals.

[adeluna2005]

I think that it is something with Windows Server 2016 Security Features buecause it works fine with a Server 2003 with the same configuration... 

[matn]

I had the same error message -455 after updating my LDAP password and found the reason was that I had my old password stored in the FortiClient Console in the Remote Access tab. Entering the new password there solved the problem for me.

[adeluna2005]

The reason of my issue was because I didnt put the "sAMAccountName" at Common Name Identifier field. So the UTM was asking for the Display Name and not for the Account Name. now is everything working properly.

Regards.

[Toshi_Esumi]

Also one of our cases was the user was not allowed "remote access" at Windows AD/LDAP. So direct domain login at the office works but SSL VPN login was rejected.

[Kieran4u]

It sounds like you're on the right track with troubleshooting the issue. Given that other users are connecting without problems, it could indeed be related to the specific users' home networks or FortiClient configuration.

Here are a few additional steps to consider:

• Verify VPN Settings: Double-check that the FortiClient settings on the affected users' devices match those of users who are successful.

• Check Local Network Issues: Ensure there are no firewall rules or security settings on their home networks blocking the VPN connection. Sometimes, ISPs or home routers might have specific settings that could interfere with VPN traffic.

• FortiClient Version: Make sure the affected users have the same version of FortiClient as the working users. Sometimes, updating or reinstalling FortiClient can resolve connectivity issues.

• Local Security Software: Check if local antivirus or security software might be interfering with the VPN connection. Temporarily disabling these can help diagnose if they're the cause.

• Logs and Support: Review the FortiGate and FortiClient logs for any additional error messages or clues. If the problem persists, reaching out to Fortinet support with detailed logs could provide further assistance.

I hope these suggestions help resolve the issue! For more insights, you can click here.