Host Check Failures on FortiGate SSL VPN with macOS Sonoma

[wbaiden]

Hello, everyone.

I have a question regarding the host check feature on FortiGate SSL VPN.

Here are the version details:

• FortiGate 61F v7.4.4 build 2662
• FortiClient VPN 7.4.0.1645
• macOS Sonoma 14.6.1

I configured the host check policy as follows:

config vpn ssl web host-check-software

edit "test_mac"
set os-type macos
config check-item-list
edit 1
set type process
set target "kernel_task"

config vpn ssl web portal

edit "split-tunnel"

set host-check custom
set host-check-interval 600
set host-check-policy "test_mac"

Since "kernel_task" is an essential process on macOS, it should be recognized. However, the connection to the SSL VPN always fails due to the host check.

The same issue occurs with file check.

I have given FortiClient and fctservctl2 full disk access permissions.

If I set os-type macos to windows, the connection succeed.

What could be the issue?

[kaman]

Hello wbaiden,

The issue you are facing with the host check feature on FortiGate SSL VPN seems to be related to the configuration for macOS. Here are some steps to troubleshoot the problem: 1. **Verify Process Target**: Ensure that the process target "kernel_task" is correctly specified for macOS. Double-check the process name and path to make sure it matches the macOS system. 2. **Check Permissions**: Even though you have given FortiClient and fctservctl2 full disk access permissions, verify that the permissions are correctly set for the specific process "kernel_task" as well. 3. **OS-Type Configuration**: Since changing the OS-Type to Windows allows the connection to succeed, there might be an issue with the macOS configuration. Review the macOS specific settings and ensure they are accurately configured for the host check. 4. **Debugging**: Enable real-time debugs on the FortiGate CLI to gather more information about the host check process. You can use the command `diagnose debug app sslvpn -1` and `diagnose debug enable` to enable debugging. 5. **Review Logs**: Check the FortiGate logs for any specific error messages related to the host check failure. This can provide more insights into why the macOS host check is failing.

Please refer to the below documents for more information:

https://docs.fortinet.com/document/fortigate/7.4.1/cli-reference/320620/config-vpn-ssl-web-host-chec...

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/179703/ssl-vpn-tunnel-mode-h...

[wbaiden]

Thanks for replying, Kaman.

However, I’ve already double-checked the process you mentioned multiple times.

1. I’ve tried various processes, not just kernel_task, but the results are the same.
2. I’m not sure what additional permissions are needed. I believe I’ve granted all necessary permissions.
3. I suspect there might be bugs in the host check process for macOS. Please look into this.
4. I’ve also done real-time debugging but couldn’t find any specific clues.

[luanexi2]

You normally can't click the avoid certificate button after having clicked the lock button which require admin permission usually in Windows, so it's probably the same on a Mac.