Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
schap
New Contributor

SSL VPN SSO with Azure GCC High

Hello, 

 

I am trying to get SSO setup and configured with Azure AD in GCC High. Everything seems to go through and get passed MFA but never actually finishes the connection. Does anyone have any insight? Here is some logs:

 

[268:root:5]SSL state:before SSL initialization (72.28.254.222) [268:root:5]SSL state:before SSL initialization (72.28.254.222) [268:root:5]got SNI server name: fw.steeltoads.com realm (null) [268:root:5]client cert requirement: no [268:root:5]SSL state:SSLv3/TLS read client hello (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write server hello (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write certificate (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write key exchange (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write server done (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write server done:system lib(72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write server done (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS read client key exchange (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS read change cipher spec (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS read finished (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write session ticket (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write change cipher spec (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write finished (72.28.254.222) [268:root:5]SSL state:SSL negotiation finished successfully (72.28.254.222) [268:root:5]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [268:root:5]sslvpn_read_request_common,655, ret=-1 error=-1, sconn=0x7fa4aa5fbf00. [268:root:5]Destroy sconn 0x7fa4aa5fbf00, connSize=0. (root) [269:root:5]allocSSLConn:298 sconn 0x7fa4aa5fbf00 (0:root) [269:root:5]SSL state:before SSL initialization (72.28.254.222) [269:root:5]SSL state:before SSL initialization (72.28.254.222) [269:root:5]got SNI server name: fw.steeltoads.com realm (null) [269:root:5]client cert requirement: no [269:root:5]SSL state:SSLv3/TLS read client hello (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write server hello (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write certificate (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write key exchange (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write server done (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write server done:system lib(72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write server done (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS read client key exchange (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS read change cipher spec (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS read finished (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write session ticket (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write change cipher spec (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write finished (72.28.254.222) [269:root:5]SSL state:SSL negotiation finished successfully (72.28.254.222) [269:root:5]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [269:root:5]sslvpn_read_request_common,655, ret=-1 error=-1, sconn=0x7fa4aa5fbf00. [269:root:5]Destroy sconn 0x7fa4aa5fbf00, connSize=0. (root) [270:root:5]allocSSLConn:298 sconn 0x7fa4aa5fbf00 (0:root) [270:root:5]SSL state:before SSL initialization (72.28.254.222) [270:root:5]SSL state:before SSL initialization (72.28.254.222) [270:root:5]got SNI server name: fw.steeltoads.com realm (null) [270:root:5]client cert requirement: no [270:root:5]SSL state:SSLv3/TLS read client hello (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS write server hello (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS write change cipher spec (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS write finished (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS write finished:system lib(72.28.254.222) [270:root:5]SSL state:SSLv3/TLS write finished (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS read change cipher spec (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS read finished (72.28.254.222) [270:root:5]SSL state:SSL negotiation finished successfully (72.28.254.222) [270:root:5]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [270:root:5]req: /remote/saml/start [270:root:5]rmt_web_auth_info_parser_common:444 no session id in auth info [270:root:5]rmt_web_get_access_cache:781 invalid cache, ret=4103 [270:root:5]sslvpn_auth_check_usrgroup:2324 forming user/group list from policy. [270:root:5]sslvpn_auth_check_usrgroup:2362 got user (0) group (1:0). [270:root:5]sslvpn_validate_user_group_list:1748 validating with SSL VPN authentication rules (1), realm ((null)). [270:root:5]sslvpn_validate_user_group_list:1868 checking rule 2 cipher. [270:root:5]sslvpn_validate_user_group_list:1876 checking rule 2 realm. [270:root:5]sslvpn_validate_user_group_list:1887 checking rule 2 source intf. [270:root:5]sslvpn_validate_user_group_list:1926 checking rule 2 vd source intf. [270:root:5]sslvpn_validate_user_group_list:2072 rule 2 done, got user (0:0) group (1:0) peer group (0). [270:root:5]sslvpn_validate_user_group_list:2232 got user (0:0), group (1:0) peer group (0). __samld_sp_create_auth_req [387]: **** Auth Req URL **** https://login.microsofton...urTMUoBPVoAWJUSQ%3D%3D *********************** __samld_sp_create_auth_req [394]: **** SP Login Dump **** <lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_D7000A92FA64A041934D30D6DCA8236F" Version="2.0" IssueInstant="2021-01-18T22:21:20Z" Destination="https://login.microsoftonline.us/67cf5a98-1745-448f-b7ba-edf000769522/saml2" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false"><saml:Issuer>https://fw.steeltoads.com...<samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>https://sts.windows.net/6...t;</lasso:Login> *********************** samld_send_common_reply [114]: Code: 0, id: 5, data_len: 3185 samld_send_common_reply [123]: Attr: 14, 2107, <lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_D7000A92FA64A041934D30D6DCA8236F" Version="2.0" IssueInstant="2021-01-18T22:21:20Z" Destination="https://login.microsoftonline.us/67cf5a98-1745-448f-b7ba-edf000769522/saml2" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false"><saml:Issuer>https://fw.steeltoads.com...<samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>https://sts.windows.net/6...t;</lasso:Login> samld_send_common_reply [123]: Attr: 11, 1062, https://login.microsofton...urTMUoBPVoAWJUSQ%3D%3D [270:root:5]Timeout for connection 0x7fa4aa5fbf00.

2 REPLIES 2
fiorep
New Contributor

I am having a similar error. How did you get this resolved with GHIGH and SSL VPN?

Debbie_FTNT
Staff
Staff

Hey @schap , @fiorep ,

 

FortiGate by default has a five second timeout for remote authentication (authentication against SAML, LDAP, RADIUS etc).
This can often cause issues when two-factor authentication is in play, as that typically takes more than five seconds to finish and report a successful authentication back to FortiGate.

You could try this setting:

 

 

(config global)
config system global
set remoteauthtimeout 60  ##this value is in seconds
end

 

 

If the issue persists, you can try gathering the sslvpn debug again with timestamps (dia de console timestamp en) to get a better understanding at what point FortiGate times out the connection.

EDIT: this setting does mean that in the case of connection issues to authentication servers, users might wait longer for FortiGate to report back a failure.

 

Hope this helps :)

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors