Hello, everyone.
I have a question regarding the host check feature on FortiGate SSL VPN.
Here are the version details:
I configured the host check policy as follows:
config vpn ssl web host-check-software edit "test_mac" set os-type macos config check-item-list edit 1 set type process set target "kernel_task" config vpn ssl web portal edit "split-tunnel" set host-check custom set host-check-interval 600 set host-check-policy "test_mac"
Since "kernel_task" is an essential process on macOS, it should be recognized. However, the connection to the SSL VPN always fails due to the host check.
The same issue occurs with file check.
I have given FortiClient and fctservctl2 full disk access permissions.
If I set os-type macos to windows, the connection succeed.
What could be the issue?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello wbaiden,
The issue you are facing with the host check feature on FortiGate SSL VPN seems to be related to the configuration for macOS. Here are some steps to troubleshoot the problem: 1. **Verify Process Target**: Ensure that the process target "kernel_task" is correctly specified for macOS. Double-check the process name and path to make sure it matches the macOS system. 2. **Check Permissions**: Even though you have given FortiClient and fctservctl2 full disk access permissions, verify that the permissions are correctly set for the specific process "kernel_task" as well. 3. **OS-Type Configuration**: Since changing the OS-Type to Windows allows the connection to succeed, there might be an issue with the macOS configuration. Review the macOS specific settings and ensure they are accurately configured for the host check. 4. **Debugging**: Enable real-time debugs on the FortiGate CLI to gather more information about the host check process. You can use the command `diagnose debug app sslvpn -1` and `diagnose debug enable` to enable debugging. 5. **Review Logs**: Check the FortiGate logs for any specific error messages related to the host check failure. This can provide more insights into why the macOS host check is failing.
Please refer to the below documents for more information:
https://docs.fortinet.com/document/fortigate/7.4.1/cli-reference/320620/config-vpn-ssl-web-host-chec...
https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/179703/ssl-vpn-tunnel-mode-h...
Thanks for replying, Kaman.
However, I’ve already double-checked the process you mentioned multiple times.
You normally can't click the avoid certificate button after having clicked the lock button which require admin permission usually in Windows, so it's probably the same on a Mac.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1546 | |
1030 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.