FortiClient VPN - Error 6005

[DavidAno]

Hello All,

We just updated our organization to FortiClient 7.2.4.0972 and seem to be having issues.

A little background about our setup:

We have a FortiGate 200F running FortiOS 7.0.13

We use Single Sign-On integrated with Azure

We have a valid SSL certificate that is assigned to the VPN and SSO configurations

We were previously running FortiClient 7.0.2.090 and SAML login was working fine

After installing FortiClient 7.2.4.0972 it seems that some computers are unable to connect to the VPN.  If you click the Sign-in button the window to sign into azure pops up, the authentication works fine, and then the window closes.   Immediately the VPN begins connecting, and then shows disconnecting.  A notification pops up saying that the FortiClient connection is down.  FortiClient shows an error 6005 and a warning about a certificate error.

I looked through all of the FortiClient logs on the computer in C:\ProgramFiles and Appdata, but don't see anything noteworthy that would indicate where the issue is.

This is happening for multiple computers, but not all computers.  I know all of the configuration is working because several devices are able to connect without issue using SAML.  Trying to find the common link between the computers that are not working.   

I did a debug on the firewall and this was the results

[310:root:d696]allocSSLConn:307 sconn 0x7f7d8cd5b900 (0:root)

[310:root:d696]SSL state:before SSL initialization (REMOTE IP)

[310:root:d696]SSL state:before SSL initialization (REMOTE IP)

[310:root:d696]got SNI server name: DOMAIN NAME realm (null)

[310:root:d696]client cert requirement: no

[310:root:d696]SSL state:SSLv3/TLS read client hello (REMOTE IP)

[310:root:d696]SSL state:SSLv3/TLS write server hello (REMOTE IP)

[310:root:d696]SSL state:SSLv3/TLS write certificate (REMOTE IP)

[310:root:d696]SSL state:SSLv3/TLS write key exchange (REMOTE IP)

[310:root:d696]SSL state:SSLv3/TLS write server done (REMOTE IP)

[310:root:d696]SSL state:SSLv3/TLS write server done:system lib(REMOTE IP)

[310:root:d696]SSL state:SSLv3/TLS write server done (REMOTE IP)

[310:root:d696]SSL state:SSLv3/TLS read client key exchange (REMOTE IP)

[310:root:d696]SSL state:SSLv3/TLS read change cipher spec (REMOTE IP)

[310:root:d696]SSL state:SSLv3/TLS read finished (REMOTE IP)

[310:root:d696]SSL state:SSLv3/TLS write session ticket (REMOTE IP)

[310:root:d696]SSL state:SSLv3/TLS write change cipher spec (REMOTE IP)

[310:root:d696]SSL state:SSLv3/TLS write finished (REMOTE IP)

[310:root:d696]SSL state:SSL negotiation finished successfully (REMOTE IP)

[310:root:d696]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384

[310:root:d696]req: /remote/saml/start

[310:root:d696]rmt_web_auth_info_parser_common:492 no session id in auth info

[310:root:d696]rmt_web_get_access_cache:841 invalid cache, ret=4103

[310:root:d696]sslvpn_auth_check_usrgroup:2978 forming user/group list from policy.

[310:root:d696]sslvpn_auth_check_usrgroup:3024 got user (0) group (2:0).

[310:root:d696]sslvpn_validate_user_group_list:1890 validating with SSL VPN authentication rules (2), realm ((null)).

[310:root:d696]sslvpn_validate_user_group_list:1975 checking rule 1 cipher.

[310:root:d696]sslvpn_validate_user_group_list:1983 checking rule 1 realm.

[310:root:d696]sslvpn_validate_user_group_list:1994 checking rule 1 source intf.

[310:root:d696]sslvpn_validate_user_group_list:2033 checking rule 1 vd source intf.

[310:root:d696]sslvpn_validate_user_group_list:2526 rule 1 done, got user (0:0) group (1:0) peer group (0).

[310:root:d696]sslvpn_validate_user_group_list:1975 checking rule 2 cipher.

[310:root:d696]sslvpn_validate_user_group_list:1983 checking rule 2 realm.

[310:root:d696]sslvpn_validate_user_group_list:1994 checking rule 2 source intf.

[310:root:d696]sslvpn_validate_user_group_list:2526 rule 2 done, got user (0:0) group (2:0) peer group (0).

[310:root:d696]sslvpn_validate_user_group_list:2534 got user (0:0) group (2:0) peer group (0).

[310:root:d696]sslvpn_validate_user_group_list:2876 got user (0:0), group (2:0) peer group (0).

[310:root:d696]sslvpn_update_user_group_list:1793 got user (0:0), group (2:0), peer group (0) after update.

[310:root:d696][fsv_found_saml_server_name_from_auth_lst:123] Found SAML server [azure] in group [Azure VPN Users]

[310:root:d696]Timeout for connection 0x7f7d8cd5b900.

[310:root:d696]Destroy sconn 0x7f7d8cd5b900, connSize=4. (root)

[310:root:d696]SSL state:warning close notify (REMOTE IP)

[312:root:d696]allocSSLConn:307 sconn 0x7f7d8cd56500 (0:root)

[312:root:d696]SSL state:before SSL initialization (REMOTE IP)

[312:root:d696]SSL state:before SSL initialization:DH lib(REMOTE IP)

[312:root:d696]SSL_accept failed, 5:(null)

[312:root:d696]Destroy sconn 0x7f7d8cd56500, connSize=1. (root)

[306:root:d696]allocSSLConn:307 sconn 0x7f7d8c12be00 (0:root)

[306:root:d696]SSL state:before SSL initialization (REMOTE IP)

[306:root:d696]SSL state:before SSL initialization:DH lib(REMOTE IP)

[306:root:d696]SSL_accept failed, 5:(null)

[306:root:d696]Destroy sconn 0x7f7d8c12be00, connSize=5. (root)

[307:root:d697]allocSSLConn:307 sconn 0x7f7d8cd56500 (0:root)

[307:root:d697]SSL state:before SSL initialization (REMOTE IP)

[307:root:d697]SSL state:before SSL initialization:DH lib(REMOTE IP)

[307:root:d697]SSL_accept failed, 5:(null)

[307:root:d697]Destroy sconn 0x7f7d8cd56500, connSize=2. (root)

[ozkanaltas]

Hello @DavidAno ,

Did you check this document before? I think, similar to your problem.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-fix-the-error-Unable-to-estab...

Also, I remember the SAML auth has a bug in version 7.0. This bug is related to SAML url's. 

Can you check saml URL. If the SAML URL contains a question mark end of the URL this bug is triggered. 

Can you reconfigure your SAML URLs without a question mark?

[DavidAno]

Hello Ozkanaltas,

I did look at that document, but the error message is different even though the number is the same.  That error indicates the server can not be reached, but ours notes some kind of certificate error (trying to get the exact verbiage) 

Our Gateway is reachable, and we are able to pass authentication from the browser.

Our SAML URL does not contain any question marks.

[DavidAno]

The exact error we are getting is

FrotiClientThe server you want to connect to requests identification, please choose a certificate and try again. (- "6005)"

This almost seems like its expecting certificate based authentication, even though that is disabled on the firewall.

Other computers with the same OS, same FortiClient version, same SAML user are working fine, cant figure out why these few devices are having issues and saying it needs a certificate.

I have completely uninstalled and reinstalled and that did not fix the issue either.

[DavidAno]

Ok I was able to narrow the issue down to certificates that exist on the user's profile.   Forticlient seems to be trying every certificate that exists, even if its set to use none.   Since none of the certificates work then it just closes the connection.  

I am going to open a new thread now that i have more details.

[SH2024]

We have the exact same problem. I just called support and they said developers are working on it, and advised us to go to 7.3.  What thread did you open up?

[DavidAno]

Glad to know its not just us.   

New thread here - https://community.fortinet.com/t5/Support-Forum/Forticlient-7-2-4-trying-to-use-certificates-when-no...

[LeoLi]

This issue more than likely caused by not finishing IdP authentication after reach FortiGate remoteauthtimeout.

When this happens, please try to connect from FortiClient FortiTray, rather than GUI. and try to finish IdP authentication within the remoteauthtimeout.

-6005 recorded in Notifications may not correct and need to fix.

[DavidAno]

It is definitely a bug.   As soon as i remove the certificates from the personal certificates store the VPN begins working correctly.

[LeoLi]

Hello DavidAno,
Please do you have a way to reproduce the issue consistently. Assumed that 
- FGT SSLVPN settings -> require client certificate is OFF
- FortiClient SAML VPN tunnel doesn't require certificate (prompt certificate is OFF)

- For SAML login, FortiClient 7.2.4 only validate FortiGate Server Certificate, if failed to validate it, then FCT just prompts certificate alert. 

- What other FCT features are enabled and visible on its GUI in your case
If you could provide more detail in your case, then that would be helpful to solve the issue.
Meanwhile pls try to access your remote gateway with its IP or FQDN (format like https://gatewayIP or FQDN:port/remote/login), then click "Single Sign On" to see if or not it works properly (for the test, FCT is not invloved in at all)
Thanks!