FortiClient VPN - 7.4 with SAML SSO with Azure AD crashes and does not connect

[rabbit23]

Hello Guys,

We have quite a problem with the VPN after two simultaneous steps:
1. Migrating from version 7.2.4 to 7.4. We are using free version of FortiClient VPN 7.4.0.1658.
2. Changing the authentication from user auth to SAML SSO login for SSL VPN with Azure AD acting as SAML IdP (with external browser as user-agent for saml user authentication).

As a result, we observe 2 main problems:
1. connection crashes at 98%
2. connection does not start at all - percentages not showing the progress of connection

This happens on both Win10 and Win11. The problems are not deterministic - one day they occur on a particular client, the next day they are fine. Sometimes reinstalling the VPN client helps for a while. Sometimes you have to retry, and after several attempts it will finally connect.

Logs are attached below. I would appreciate any tips and help.

"30/07/2024 08:52:12	warning	sslvpn	CSslvpnAgent::InitPipeHandle() 137 CreateFile() failed.. LastError=231"
"30/07/2024 08:54:13	error	sslvpn	error: ras_loop(), waitResult=258."
"30/07/2024 08:55:49	error	sslvpn	date=2024-07-30 time=08:55:48 logver=1 id=96603 type=securityevent subtype=sslvpn eventtype=error level=error uid=xxx devid=xxx hostname=xxx pcdomain=xxx deviceip=192.168.1.10 devicemac=xxx site=N/A fctver=7.4.0.1658 fgtserial=xxx emsserial=N/A os="Microsoft Windows 10 Professional Edition, 64-bit (build 19045)" user=xxx msg="SSLVPN tunnel connection failed" vpnstate= vpntunnel=CLVPN-Azure remotegw=xxx"

8/1/2024 3:22:21 PM	warning	sslvpn	CSslvpnAgent::InitPipeHandle() 137 CreateFile() failed.. LastError=231
8/1/2024 5:22:50 PM	error	sslvpn	error: WSAEnumNetworkEvents FD_CLOSE (10053)
8/1/2024 5:37:00 PM	error	sslvpn	error: poll_recv_ssl -> SSL_get_error(): 5
8/1/2024 5:37:00 PM	error	sslvpn	error: poll_recv_ssl -> WSAGetLastError():2746

05/08/2024 11:05:29	error	sslvpn	error: ras_loop(), waitResult=1.
05/08/2024 11:05:29	error	sslvpn	failed to create tunnel_thread thread
05/08/2024 11:05:29	error	sslvpn	failed to create ras_thread thread
05/08/2024 11:05:29	error	sslvpn	failed to create monitor_thread thread
05/08/2024 11:06:06	error	sslvpn	error: ras_loop(), waitResult=1.
05/08/2024 11:06:06	error	sslvpn	failed to create tunnel_thread thread
05/08/2024 11:06:06	error	sslvpn	failed to create ras_thread thread
05/08/2024 11:06:06	error	sslvpn	failed to create monitor_thread thread
05/08/2024 11:06:36	info	sslvpn	date=2024-08-05 time=11:06:35 logver=1 id=96600 type=securityevent subtype=sslvpn eventtype=status level=info uid=xxx devid=xxx hostname=xxx pcdomain=xxx deviceip=172.29.208.1 devicemac=xxx site=N/A fctver=7.4.0.1658 fgtserial=xxx emsserial=N/A os="Microsoft Windows 10 Professional Edition, 64-bit (build 19045)" user=xxx msg="SSLVPN tunnel status" vpnstate=disconnected vpntunnel=CLVPN-Azure

[patelr]

Hello @rabbit23 ,

Please check https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-fails-at-98/ta-p/248363 and review FortiClient logs, as it will provide descriptive information on why connection is getting terminated at 98%. To enable logs on FortiClient, please review https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-enable-debug-log-in-FortiClient/t....

Thanks,

Ronak Patel 

[rabbit23]

Thank you. Debug was enabled for 3 machines where I collected above logs from. I'll check IPv6 as it might be enabled.

[Shashwati]

Hello,

Regarding the error error: poll_recv_ssl -> WSAGetLastError():2746, please refer to the following document

https://community.fortinet.com/t5/FortiClient/Technical-Tip-Interpreting-WSAGetLastError-in-FortiCli...

[rabbit23]

What does it mean? "An established connection was aborted by the software in the host computer, possibly due to a data transmission time-put or protocol error."

This is frequent issue, not one-time only. On same host it sometimes works sometimes not therefore how it might be protocol issue?

[hbac]

Hi @rabbit23,

Did you have issues on FortiClient 7.2.4? Do you have any third party antivirus or VPN client installed? 

Regards,

[ndumaj]

Hello @rabbit23 

Please perform steps one by one, upgrading FCT from 7.2.4 to 7.4.0 does it work or not?
Does the setup work on Web SSL mode?

Does the SSL VPN in Web mode with Azure AD acting as SAML works?
Please enable the following debug:

diagnose debug reset

diagnose debug console timestamp enable

diagnose debug application samld -1

diagnose debug application sslvpn -1

diagnose debug enable

 BR

[rabbit23]

Yes, same exists on 7.2.4 as I downgraded one client for test purposes. Logs from today below.

TrendMicro Security Agent installed, no more VPN clients

08/08/2024 08:57:14	warning	sslvpn	CSslvpnAgent::InitPipeHandle() 137 CreateFile() failed.. LastError=231
08/08/2024 08:57:14	error	sslvpn	Failed to connect to SslvpnDaemon, LastError=0
08/08/2024 08:57:14	error	sslvpn	CSslvpnAgent::Initialize() 178 InitPipeHandle() failed.
08/08/2024 08:58:30	error	sslvpn	error: ras_loop(), waitResult=1.
08/08/2024 08:59:36	error	sslvpn	error: poll_recv_ssl -> SSL_get_error(): 6
08/08/2024 08:59:36	error	sslvpn	error: poll_recv_ssl -> WSAGetLastError():0
08/08/2024 08:59:36	info	sslvpn	error: polling recv, try:3
08/08/2024 09:01:12	info	sslvpn	date=2024-08-08 time=09:01:11 logver=1 id=96600 type=securityevent subtype=sslvpn eventtype=status level=info uid=xxx devid=xxx hostname=xxx pcdomain=xxx deviceip=192.168.1.10 devicemac=xxx site=N/A fctver=7.2.4.0972 fgtserial=xxx emsserial=N/A os="Microsoft Windows 10 Professional Edition, 64-bit (build 19045)" user=xxx msg="SSLVPN tunnel status" vpnstate=disconnected vpntunnel=CLVPN-Azure
08/08/2024 09:01:37	warning	sslvpn	CSslvpnAgent::InitPipeHandle() 137 CreateFile() failed.. LastError=231
08/08/2024 09:01:37	warning	sslvpn	Server is busy. Waiting...

[ndumaj]

Well, not too much information on the logs?!

Does it work in Web SSL mode?

Check the timer settings:

Increase remoteauthtimeout to 120 seconds under 'config system global'?

config system global

set remoteauthtimeout 120

end

Review the following community link:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-and-two-factor-expiry-timers...

[hbac]

Hi @rabbit23,

Does it work if you don't use SAML? Please refer to this link: https://docs.fortinet.com/document/forticlient/7.2.4/windows-release-notes/683433/special-notices#SS...

Regards,