Hello Guys,
We have quite a problem with the VPN after two simultaneous steps:
1. Migrating from version 7.2.4 to 7.4. We are using free version of FortiClient VPN 7.4.0.1658.
2. Changing the authentication from user auth to SAML SSO login for SSL VPN with Azure AD acting as SAML IdP (with external browser as user-agent for saml user authentication).
As a result, we observe 2 main problems:
1. connection crashes at 98%
2. connection does not start at all - percentages not showing the progress of connection
This happens on both Win10 and Win11. The problems are not deterministic - one day they occur on a particular client, the next day they are fine. Sometimes reinstalling the VPN client helps for a while. Sometimes you have to retry, and after several attempts it will finally connect.
Logs are attached below. I would appreciate any tips and help.
"30/07/2024 08:52:12 warning sslvpn CSslvpnAgent::InitPipeHandle() 137 CreateFile() failed.. LastError=231"
"30/07/2024 08:54:13 error sslvpn error: ras_loop(), waitResult=258."
"30/07/2024 08:55:49 error sslvpn date=2024-07-30 time=08:55:48 logver=1 id=96603 type=securityevent subtype=sslvpn eventtype=error level=error uid=xxx devid=xxx hostname=xxx pcdomain=xxx deviceip=192.168.1.10 devicemac=xxx site=N/A fctver=7.4.0.1658 fgtserial=xxx emsserial=N/A os="Microsoft Windows 10 Professional Edition, 64-bit (build 19045)" user=xxx msg="SSLVPN tunnel connection failed" vpnstate= vpntunnel=CLVPN-Azure remotegw=xxx"
8/1/2024 3:22:21 PM warning sslvpn CSslvpnAgent::InitPipeHandle() 137 CreateFile() failed.. LastError=231
8/1/2024 5:22:50 PM error sslvpn error: WSAEnumNetworkEvents FD_CLOSE (10053)
8/1/2024 5:37:00 PM error sslvpn error: poll_recv_ssl -> SSL_get_error(): 5
8/1/2024 5:37:00 PM error sslvpn error: poll_recv_ssl -> WSAGetLastError():2746
05/08/2024 11:05:29 error sslvpn error: ras_loop(), waitResult=1.
05/08/2024 11:05:29 error sslvpn failed to create tunnel_thread thread
05/08/2024 11:05:29 error sslvpn failed to create ras_thread thread
05/08/2024 11:05:29 error sslvpn failed to create monitor_thread thread
05/08/2024 11:06:06 error sslvpn error: ras_loop(), waitResult=1.
05/08/2024 11:06:06 error sslvpn failed to create tunnel_thread thread
05/08/2024 11:06:06 error sslvpn failed to create ras_thread thread
05/08/2024 11:06:06 error sslvpn failed to create monitor_thread thread
05/08/2024 11:06:36 info sslvpn date=2024-08-05 time=11:06:35 logver=1 id=96600 type=securityevent subtype=sslvpn eventtype=status level=info uid=xxx devid=xxx hostname=xxx pcdomain=xxx deviceip=172.29.208.1 devicemac=xxx site=N/A fctver=7.4.0.1658 fgtserial=xxx emsserial=N/A os="Microsoft Windows 10 Professional Edition, 64-bit (build 19045)" user=xxx msg="SSLVPN tunnel status" vpnstate=disconnected vpntunnel=CLVPN-Azure
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello @rabbit23 ,
Please check https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-fails-at-98/ta-p/248363 and review FortiClient logs, as it will provide descriptive information on why connection is getting terminated at 98%. To enable logs on FortiClient, please review https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-enable-debug-log-in-FortiClient/t....
Thanks,
Ronak Patel
Thank you. Debug was enabled for 3 machines where I collected above logs from. I'll check IPv6 as it might be enabled.
Hello,
Regarding the error error: poll_recv_ssl -> WSAGetLastError():2746, please refer to the following document
What does it mean? "An established connection was aborted by the software in the host computer, possibly due to a data transmission time-put or protocol error."
This is frequent issue, not one-time only. On same host it sometimes works sometimes not therefore how it might be protocol issue?
Hi @rabbit23,
Did you have issues on FortiClient 7.2.4? Do you have any third party antivirus or VPN client installed?
Regards,
Hello @rabbit23
Please perform steps one by one, upgrading FCT from 7.2.4 to 7.4.0 does it work or not?
Does the setup work on Web SSL mode?
Does the SSL VPN in Web mode with Azure AD acting as SAML works?
Please enable the following debug:
diagnose debug reset
diagnose debug console timestamp enable
diagnose debug application samld -1
diagnose debug application sslvpn -1
diagnose debug enable
BR
Yes, same exists on 7.2.4 as I downgraded one client for test purposes. Logs from today below.
TrendMicro Security Agent installed, no more VPN clients
08/08/2024 08:57:14 warning sslvpn CSslvpnAgent::InitPipeHandle() 137 CreateFile() failed.. LastError=231
08/08/2024 08:57:14 error sslvpn Failed to connect to SslvpnDaemon, LastError=0
08/08/2024 08:57:14 error sslvpn CSslvpnAgent::Initialize() 178 InitPipeHandle() failed.
08/08/2024 08:58:30 error sslvpn error: ras_loop(), waitResult=1.
08/08/2024 08:59:36 error sslvpn error: poll_recv_ssl -> SSL_get_error(): 6
08/08/2024 08:59:36 error sslvpn error: poll_recv_ssl -> WSAGetLastError():0
08/08/2024 08:59:36 info sslvpn error: polling recv, try:3
08/08/2024 09:01:12 info sslvpn date=2024-08-08 time=09:01:11 logver=1 id=96600 type=securityevent subtype=sslvpn eventtype=status level=info uid=xxx devid=xxx hostname=xxx pcdomain=xxx deviceip=192.168.1.10 devicemac=xxx site=N/A fctver=7.2.4.0972 fgtserial=xxx emsserial=N/A os="Microsoft Windows 10 Professional Edition, 64-bit (build 19045)" user=xxx msg="SSLVPN tunnel status" vpnstate=disconnected vpntunnel=CLVPN-Azure
08/08/2024 09:01:37 warning sslvpn CSslvpnAgent::InitPipeHandle() 137 CreateFile() failed.. LastError=231
08/08/2024 09:01:37 warning sslvpn Server is busy. Waiting...
Well, not too much information on the logs?!
Does it work in Web SSL mode?
Check the timer settings:
Increase remoteauthtimeout to 120 seconds under 'config system global'?
config system global
set remoteauthtimeout 120
end
Review the following community link:
Hi @rabbit23,
Does it work if you don't use SAML? Please refer to this link: https://docs.fortinet.com/document/forticlient/7.2.4/windows-release-notes/683433/special-notices#SS...
Regards,
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1732 | |
1106 | |
752 | |
447 | |
240 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.