SSL VPN SSO with Azure GCC High

[schap]

Hello, 

I am trying to get SSO setup and configured with Azure AD in GCC High. Everything seems to go through and get passed MFA but never actually finishes the connection. Does anyone have any insight? Here is some logs:

[268:root:5]SSL state:before SSL initialization (72.28.254.222) [268:root:5]SSL state:before SSL initialization (72.28.254.222) [268:root:5]got SNI server name: fw.steeltoads.com realm (null) [268:root:5]client cert requirement: no [268:root:5]SSL state:SSLv3/TLS read client hello (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write server hello (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write certificate (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write key exchange (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write server done (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write server done:system lib(72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write server done (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS read client key exchange (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS read change cipher spec (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS read finished (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write session ticket (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write change cipher spec (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write finished (72.28.254.222) [268:root:5]SSL state:SSL negotiation finished successfully (72.28.254.222) [268:root:5]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [268:root:5]sslvpn_read_request_common,655, ret=-1 error=-1, sconn=0x7fa4aa5fbf00. [268:root:5]Destroy sconn 0x7fa4aa5fbf00, connSize=0. (root) [269:root:5]allocSSLConn:298 sconn 0x7fa4aa5fbf00 (0:root) [269:root:5]SSL state:before SSL initialization (72.28.254.222) [269:root:5]SSL state:before SSL initialization (72.28.254.222) [269:root:5]got SNI server name: fw.steeltoads.com realm (null) [269:root:5]client cert requirement: no [269:root:5]SSL state:SSLv3/TLS read client hello (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write server hello (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write certificate (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write key exchange (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write server done (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write server done:system lib(72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write server done (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS read client key exchange (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS read change cipher spec (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS read finished (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write session ticket (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write change cipher spec (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write finished (72.28.254.222) [269:root:5]SSL state:SSL negotiation finished successfully (72.28.254.222) [269:root:5]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [269:root:5]sslvpn_read_request_common,655, ret=-1 error=-1, sconn=0x7fa4aa5fbf00. [269:root:5]Destroy sconn 0x7fa4aa5fbf00, connSize=0. (root) [270:root:5]allocSSLConn:298 sconn 0x7fa4aa5fbf00 (0:root) [270:root:5]SSL state:before SSL initialization (72.28.254.222) [270:root:5]SSL state:before SSL initialization (72.28.254.222) [270:root:5]got SNI server name: fw.steeltoads.com realm (null) [270:root:5]client cert requirement: no [270:root:5]SSL state:SSLv3/TLS read client hello (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS write server hello (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS write change cipher spec (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS write finished (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS write finished:system lib(72.28.254.222) [270:root:5]SSL state:SSLv3/TLS write finished (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS read change cipher spec (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS read finished (72.28.254.222) [270:root:5]SSL state:SSL negotiation finished successfully (72.28.254.222) [270:root:5]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [270:root:5]req: /remote/saml/start [270:root:5]rmt_web_auth_info_parser_common:444 no session id in auth info [270:root:5]rmt_web_get_access_cache:781 invalid cache, ret=4103 [270:root:5]sslvpn_auth_check_usrgroup:2324 forming user/group list from policy. [270:root:5]sslvpn_auth_check_usrgroup:2362 got user (0) group (1:0). [270:root:5]sslvpn_validate_user_group_list:1748 validating with SSL VPN authentication rules (1), realm ((null)). [270:root:5]sslvpn_validate_user_group_list:1868 checking rule 2 cipher. [270:root:5]sslvpn_validate_user_group_list:1876 checking rule 2 realm. [270:root:5]sslvpn_validate_user_group_list:1887 checking rule 2 source intf. [270:root:5]sslvpn_validate_user_group_list:1926 checking rule 2 vd source intf. [270:root:5]sslvpn_validate_user_group_list:2072 rule 2 done, got user (0:0) group (1:0) peer group (0). [270:root:5]sslvpn_validate_user_group_list:2232 got user (0:0), group (1:0) peer group (0). __samld_sp_create_auth_req [387]: **** Auth Req URL **** https://login.microsofton...urTMUoBPVoAWJUSQ%3D%3D *********************** __samld_sp_create_auth_req [394]: **** SP Login Dump **** <lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_D7000A92FA64A041934D30D6DCA8236F" Version="2.0" IssueInstant="2021-01-18T22:21:20Z" Destination="https://login.microsoftonline.us/67cf5a98-1745-448f-b7ba-edf000769522/saml2" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false"><saml:Issuer>https://fw.steeltoads.com...<samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>https://sts.windows.net/6...t;</lasso:Login> *********************** samld_send_common_reply [114]: Code: 0, id: 5, data_len: 3185 samld_send_common_reply [123]: Attr: 14, 2107, <lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_D7000A92FA64A041934D30D6DCA8236F" Version="2.0" IssueInstant="2021-01-18T22:21:20Z" Destination="https://login.microsoftonline.us/67cf5a98-1745-448f-b7ba-edf000769522/saml2" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false"><saml:Issuer>https://fw.steeltoads.com...<samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>https://sts.windows.net/6...t;</lasso:Login> samld_send_common_reply [123]: Attr: 11, 1062, https://login.microsofton...urTMUoBPVoAWJUSQ%3D%3D [270:root:5]Timeout for connection 0x7fa4aa5fbf00.

[fiorep]

I am having a similar error. How did you get this resolved with GHIGH and SSL VPN?

[Debbie_FTNT]

Hey @schap , @fiorep ,

FortiGate by default has a five second timeout for remote authentication (authentication against SAML, LDAP, RADIUS etc).
This can often cause issues when two-factor authentication is in play, as that typically takes more than five seconds to finish and report a successful authentication back to FortiGate.

You could try this setting:

(config global)
config system global
set remoteauthtimeout 60  ##this value is in seconds
end

If the issue persists, you can try gathering the sslvpn debug again with timestamps (dia de console timestamp en) to get a better understanding at what point FortiGate times out the connection.

EDIT: this setting does mean that in the case of connection issues to authentication servers, users might wait longer for FortiGate to report back a failure.

Hope this helps :)