Hi team, After upgrading our FortiGate to FortiOS 7.2.12, SSL VPN connections via FortiClient were consistently disconnecting at 40% during tunnel setup.
This issue did not occur on 7.2.11. After downgrading to FortiOS 7.2.11, SSL VPN connections are now stable and working as expected.
Could you help me troubleshoot this issue further to confirm root cause and ensure safe upgrade paths in the future?
Solved! Go to Solution.
I had the same problem. Are you using Entra as your IdP?
If so, check the following article. Fortinet 7.2.12 and 7.6.4 Azure SAML signing issue | TravelingPacket - A blog of network musings
It worked for me.
Hi @Toshi_Esumi, from my understanding, each Enterprise Application is corresponding to one FortiGate thus changing Signing Option to 'Sign SAML response and assertion' only applies to the corresponding FortiGate.
@GeorgeZhong I guess I asked this in a wrong way. What I wanted to ask was...
Would it break the communication if it's set as 'Sign SAML response and assertion' while a FGT is still running 7.2.11 (before upgrading to 7.2.12)?
Toshi
Never mind. Our customer couldn't wait the answer and made the change on the Entra ID side before we upgrade the FGT to 7.2.12, then confirmed it still worked fine.
The SSL VPN web and tunnel mode feature will not be available from the GUI or the CLI on the FortiGate G-Series Entry-Level models, including 90G and variants. Settings will not be upgraded from previous versions.
Consider migrating to using IPsec Dialup VPN for remote access. See FortiOS SSL VPN to IPsec VPN migration.
We were running 7.2.11.1241 perfectly with Saml (Entra ID) authentication. Since update to 7.2.12.1269 due to high vulnerability in previous version, connection is now broken. It connects successfully but will simply disconnect right behind. on some occasion it will also remain stuck to 98%. clean install, clean PC, easily reproducible on several machine. Running Windows 11 25h2 and latest November update. I tried to change the saml parameters as described below but same behavior. I can't neither update to 7.4.4 because we only need the FortclientVPN Client and not the full suite. Please release a new 7.2.13 ASAP that could fix this issue !
parameters of the client as below (always worked in the past with previous versions).
SSL Options:
enable single sign on ==> ticked
use external browser as user agent.. ==> unticked
enable autologin with azure active directory ==> unticked
enable dual stack ==> unticked
VPN Options:
Preferred DTLS Tunnel ==> ticked
Do not modify internal cookies ==> ticked
do not warn invalid cer ==> unticked
Thank you
can be ignored, a proxy was blocking the connection. Thx
| User | Count |
|---|---|
| 2783 | |
| 1423 | |
| 812 | |
| 746 | |
| 455 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.
