SSL VPN Doesn't work after firmware update 7.2.12

[s_farazin]

Hi team, After upgrading our FortiGate to FortiOS 7.2.12, SSL VPN connections via FortiClient were consistently disconnecting at 40% during tunnel setup.
This issue did not occur on 7.2.11. After downgrading to FortiOS 7.2.11, SSL VPN connections are now stable and working as expected.
Could you help me troubleshoot this issue further to confirm root cause and ensure safe upgrade paths in the future?

[GeorgeZhong]

Hi,

There could be multiple factors that cause the SSLVPN connection failed at 40% as mentioned in below document:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Possible-reasons-for-FortiClient-SSL...

It is suggested to execute below debug commands in the FortiGate CLI and reproduce this issue so we can have more visibility on the issue:

diagnose debug disable
diagnose debug reset
diagnose debug application sslvpn -1

diagnose debug application fnbamd -1

diagnose debug enable

[Toshi_Esumi]

As in the KB @GeorgeZhong referred to, 40% means it could be a TLS or certificate issue. 
But did you check "diag debug config-error-log read" when you upgraded to 7.2.12? It might have lost something during the config conversion. Or if you're using default "Fortinet_Factory" cert for SSL VPN, that might have gotten corrupted. In that case you should be able to see some config errors in the diag command.
We recently (last week) upgraded one of our 1000F clusters from 7.2.11 to 7.2.12 due to NP7 related bugs. But SSL VPN on that cluster is still working fine.

By the way, "diag debug app sslvpn -1" would give you the clue, if not the answer, why it drops the connection attempts during the negotiation.

Toshi 

[ERK]

I had the same problem. Are you using Entra as your IdP? 
If so, check the following article. Fortinet 7.2.12 and 7.6.4 Azure SAML signing issue | TravelingPacket - A blog of network musings
It worked for me.

[HMIndustrialEPC]

THANK YOU Erik! My Thursday morning has improved thanks to your post. 

[ERK]

Credit to Justin Cottrell (cjcott01), author of the post!

[GeorgeZhong]

Hi @ERK and @HMIndustrialEPC,

Thank you very much for sharing. Please find the Fortinet document for this behaviour change.

https://docs.fortinet.com/document/fortigate/7.2.12/fortios-release-notes/684249/saml-certificate-ve...

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SAML-Authentication-fails-after-firm...

Regards,

George

[Toshi_Esumi]

One last question for the Entra ID setting, @GeorgeZhong 

Would you expect this "assertion + responses" signing option breaks SAML with 7.2.11 and older versions? If so we need to separate the Enterprise apps if we have multiple FGTs in mix of <=7.2.11 and 7.2.12.

Toshi