RDP connections via bookmarks link on VPNSSL web portal are not working

[Laurent38]

Hello, I' ve setup VPNSSL for RDP connections. When using a forticlient, RDP connections are working fine. I' ve configured web portal with followinfg widgets: " bookmarks" " tunnel VPNSSL" and " informations" When connectiong on web portal and launching the tunnel, the tunnel is getting up , and launching a rdp connections is OK BUT when clicking on bookmark link which is a RDP link, the screen is locked on " launching RDP Session..." during several minutes and at the end I get the message: " Connection exception Connection to remote desktop failed, please check network connection or remote computer configuration" My architecture is Quite straight forward: 2 FG110C in cluster mode. VPNSSL configured for accessing a RDP server behind ( 10.103.X.X) Fg110C cluster is the main gateway on the RDP server . thanks for your help

[aldabol]

i have the same scenario , but when RDP i s working by forti client is running well & through portal the messege apear , SSL NEGOTIATION FAILD ,Please check your fortigate configuration. help me

[svacs]

Do you get that same error if you use the computer' s domain name instead of IP?

[Laurent38]

No, when using FQDN, I' ve got the " SSl negociation failed,please check your Fortigate configuration" message....

[svacs]

I just had a play with the vpn here and I can replicate the issue you' re having. For me to replicate the issue what I had to do was remove the server to be accessed via RDP from the ssl.root? int. to LAN int. policy rule (SSL VPN Tunnel Range of IPs as the source, RDP Server as the Destination in a firewall group). This gave me the ssl negotiation error message you' re receiving. Let me know if this helps :)

[Laurent38]

Hi, Nope, I do have the FW policy ( ssl.root to RDP server) for the RDP port. The other FW policy are also there. I' ve created a ticket on official support but after 5 days, still no answer yet...

[svacs]

damn, the only other thing I can think of if you' re not getting a response is to debug it with: config global diag debug app sslvpn -1 diag debug enable then when you' re fnished: diag debug reset diag debug disable I would love to know what the issue is! I' ve only recently setup a VPN so the more info I can get the better!

[Laurent38]

Hi , thanks for your advises, I try watching traces on debug mode : I get these messages: ------------------------------------------------------------------ rmt_websession.c:310 decode session id ok, user=[CFF],group=[TSESERVER],host=[90.80.X.X],idx=0,auth=1,login=1339059711 CONNECT to tseserver on port 3389 SSL state:warning close notify (90.80.X.X) SSL state:warning close notify (90.80.X.X) Destroy sconn 0x419c9400, connSize=2. SSL state:before/accept initialization (90.80.X.X) SSL state:SSLv2/v3 read client hello A:system lib(90.80.X.X) SSL state:SSLv3 read client hello A (90.80.X.X) SSL state:SSLv3 write server hello A (90.80.X.X) SSL state:SSLv3 write change cipher spec A (90.80.X.X) SSL state:SSLv3 write finished B (90.80.X.X) SSL state:SSLv3 flush data (90.80.X.X) SSL state:SSLv3 read finished A:system lib(90.80.X.X) SSL state:SSLv3 read finished A (90.80.X.X) SSL state:SSL negotiation finished successfully (90.80.X.X) SSL established: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 rmt_websession.c:310 decode session id ok, user=[CFF],group=[TSESERVER],host=[90.80.X.X],idx=0,auth=1,login=1339059711 rmt_websession.c:310 decode session id ok, user=[CFF],group[TSESERVER],host=[90.80.X.X],idx=0,auth=1,login=1339059711 SSL state:warning close notify (90.80.X.X) SSL state:warning close notify (90.80.X.X) Destroy sconn 0x419c9800, connSize=2. SSL state:warning close notify (90.80.X.X) Destroy sconn 0x419c9c00, connSize=1. rmt_websession.:310 decode session id ok, user=[CFF],group[TSESERVER],host=[90.80.X.X],idx=0,auth=1,login=1339059711 rmt_websession.:310 decode session id ok, user=[CFF],group[TSESERVER],host=[90.80.X.X],idx=0,auth=1,login=1339059711 SSL state:warning close notify (90.80.X.X) SSL state:warning close notify (90.80.X.X) Destroy sconn 0x419c9400, connSize=0. SSL state:before/accept initialization (90.80.X.X) SSL state:SSLv2/v3 read client hello A:system lib(90.80.X.X) SSL state:SSLv3 read client hello A (90.80.X.X) SSL state:SSLv3 write server hello A (90.80.X.X) SSL state:SSLv3 write change cipher spec A (90.80.X.X) SSL state:SSLv3 write finished B (90.80.X.X) SSL state:SSLv3 flush data (90.80.X.X) SSL state:SSLv3 read finished A:system lib(90.80.X.X) SSL state:SSLv3 read finished A (90.80.X.X) SSL state:SSL negotiation finished successfully (90.80.X.X) SSL established: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 ---------------------------------------------------- I' m not sure how to interpret these logs: and especially line " Destroy sconn ..." ( seems tha SSL connection is getting up and down, but I' ve got that behaviour even when RDP connection is working under the tunnel mode....)