Issues with DTLS, SAML Authentication, and VNC Over SSL VPN on iOS Devices

[jhe]

Hello,

I am experiencing a complex issue with SSL VPN connections on iOS devices using FortiClient and FortiClient VPN apps. Below, I detail the problems and the steps I've taken so far. Any guidance or suggestions from the community would be greatly appreciated.

Issue Summary:

1. iOS clients using Forticlient VPN cannot connect to the SSL VPN via Azure SAML if DTLS is enabled. Disabling DTLS allows the connection to be established.
2. Once connected (with DTLS disabled), all services that i have tested work except for VNC.
3. When not using SAML for authentication, VNC does work but only if DTLS is enabled.
4. There are different behaviors noted between the two iOS apps (FortiClient and FortiClient VPN) regarding DTLS and VNC functionality.
5. Using Forticlient EMS with SAML with or without DTLS connects and everything works except VNC.

Environment:

• FortiGate Model: FG200F
• FortiOS Version: 7.2.5
• FortiClient Version on iOS: 7.2.2
• IOS Version: 16, 17.0.3 and 17.1 Tested
• Affected Devices: iOS devices only (Works on Mac, Win and Android)

---

Best regards,

[hbac]

Hi @jhe, 

It is a known issue and has already been discussed here.

Regards, 

[jhe]

Hi @hbac 

Yes i'm aware of the issue with connecting and DTLS

But my issue is deeper than that.
Even if i apply the workaround and am able to connect i'm not able to use VNC over the connection.

This issue is also on the Forticlient EMS app.

[hbac]

@jhe,

Since you have FortiClient EMS, I would suggest opening a ticket with FortiClient technical support team to troubleshoot the issue. 

Regards, 

[jhe]

@hbac

I tested using the trial version of the app.

[Markus_M]

The question may be what exactly on VNC "is not working". Timeout, connection reset, screen coming up, then closing. They all will have different areas to look at.

VNC is a protocol like any other would be, causing traffic from your workstation to another node, the server. On the FortiGate you should capture whether the VNC traffic (tcp/5900 default) when you initiate it, arrives and hits a policy (or not).

A packet capture with sniffer and flow trace debug will help with this:

---

---

diag debug console timestamp enable
diag debug flow filter port 5900
diag debug flow show iprope enable
diag debug enable
diag debug flow trace start 20 

[jhe]

@Markus_M  Thank you for the suggestion. I will further document the issue.
I can confirm that traffic is flowing when saml and dtls are both enabled and i can see packets back and forth the vnc app simply does not connect. And after i  have used RVNC no other traffic works either. I have to reconnect.

I'm 99% sure the issue is with the iOS clients.
As i mentioned vnc works perfectly fine with a local user no SAML and DTLS active.
Also works flawlessly with Windows, MacOS and Android with both SAML and DTLS enabled.