Hello,
I am trying to get SSO setup and configured with Azure AD in GCC High. Everything seems to go through and get passed MFA but never actually finishes the connection. Does anyone have any insight? Here is some logs:
[268:root:5]SSL state:before SSL initialization (72.28.254.222) [268:root:5]SSL state:before SSL initialization (72.28.254.222) [268:root:5]got SNI server name: fw.steeltoads.com realm (null) [268:root:5]client cert requirement: no [268:root:5]SSL state:SSLv3/TLS read client hello (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write server hello (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write certificate (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write key exchange (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write server done (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write server done:system lib(72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write server done (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS read client key exchange (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS read change cipher spec (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS read finished (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write session ticket (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write change cipher spec (72.28.254.222) [268:root:5]SSL state:SSLv3/TLS write finished (72.28.254.222) [268:root:5]SSL state:SSL negotiation finished successfully (72.28.254.222) [268:root:5]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [268:root:5]sslvpn_read_request_common,655, ret=-1 error=-1, sconn=0x7fa4aa5fbf00. [268:root:5]Destroy sconn 0x7fa4aa5fbf00, connSize=0. (root) [269:root:5]allocSSLConn:298 sconn 0x7fa4aa5fbf00 (0:root) [269:root:5]SSL state:before SSL initialization (72.28.254.222) [269:root:5]SSL state:before SSL initialization (72.28.254.222) [269:root:5]got SNI server name: fw.steeltoads.com realm (null) [269:root:5]client cert requirement: no [269:root:5]SSL state:SSLv3/TLS read client hello (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write server hello (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write certificate (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write key exchange (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write server done (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write server done:system lib(72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write server done (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS read client key exchange (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS read change cipher spec (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS read finished (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write session ticket (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write change cipher spec (72.28.254.222) [269:root:5]SSL state:SSLv3/TLS write finished (72.28.254.222) [269:root:5]SSL state:SSL negotiation finished successfully (72.28.254.222) [269:root:5]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [269:root:5]sslvpn_read_request_common,655, ret=-1 error=-1, sconn=0x7fa4aa5fbf00. [269:root:5]Destroy sconn 0x7fa4aa5fbf00, connSize=0. (root) [270:root:5]allocSSLConn:298 sconn 0x7fa4aa5fbf00 (0:root) [270:root:5]SSL state:before SSL initialization (72.28.254.222) [270:root:5]SSL state:before SSL initialization (72.28.254.222) [270:root:5]got SNI server name: fw.steeltoads.com realm (null) [270:root:5]client cert requirement: no [270:root:5]SSL state:SSLv3/TLS read client hello (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS write server hello (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS write change cipher spec (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS write finished (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS write finished:system lib(72.28.254.222) [270:root:5]SSL state:SSLv3/TLS write finished (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS read change cipher spec (72.28.254.222) [270:root:5]SSL state:SSLv3/TLS read finished (72.28.254.222) [270:root:5]SSL state:SSL negotiation finished successfully (72.28.254.222) [270:root:5]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [270:root:5]req: /remote/saml/start [270:root:5]rmt_web_auth_info_parser_common:444 no session id in auth info [270:root:5]rmt_web_get_access_cache:781 invalid cache, ret=4103 [270:root:5]sslvpn_auth_check_usrgroup:2324 forming user/group list from policy. [270:root:5]sslvpn_auth_check_usrgroup:2362 got user (0) group (1:0). [270:root:5]sslvpn_validate_user_group_list:1748 validating with SSL VPN authentication rules (1), realm ((null)). [270:root:5]sslvpn_validate_user_group_list:1868 checking rule 2 cipher. [270:root:5]sslvpn_validate_user_group_list:1876 checking rule 2 realm. [270:root:5]sslvpn_validate_user_group_list:1887 checking rule 2 source intf. [270:root:5]sslvpn_validate_user_group_list:1926 checking rule 2 vd source intf. [270:root:5]sslvpn_validate_user_group_list:2072 rule 2 done, got user (0:0) group (1:0) peer group (0). [270:root:5]sslvpn_validate_user_group_list:2232 got user (0:0), group (1:0) peer group (0). __samld_sp_create_auth_req [387]: **** Auth Req URL **** https://login.microsofton...urTMUoBPVoAWJUSQ%3D%3D *********************** __samld_sp_create_auth_req [394]: **** SP Login Dump **** <lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_D7000A92FA64A041934D30D6DCA8236F" Version="2.0" IssueInstant="2021-01-18T22:21:20Z" Destination="https://login.microsoftonline.us/67cf5a98-1745-448f-b7ba-edf000769522/saml2" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false"><saml:Issuer>https://fw.steeltoads.com...<samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>https://sts.windows.net/6...t;</lasso:Login> *********************** samld_send_common_reply [114]: Code: 0, id: 5, data_len: 3185 samld_send_common_reply [123]: Attr: 14, 2107, <lasso:Login xmlns:lasso="http://www.entrouvert.org/namespaces/lasso/0.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" LoginDumpVersion="2"><lasso:Request><samlp:AuthnRequest ID="_D7000A92FA64A041934D30D6DCA8236F" Version="2.0" IssueInstant="2021-01-18T22:21:20Z" Destination="https://login.microsoftonline.us/67cf5a98-1745-448f-b7ba-edf000769522/saml2" SignType="0" SignMethod="0" ForceAuthn="false" IsPassive="false"><saml:Issuer>https://fw.steeltoads.com...<samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true"/></samlp:AuthnRequest></lasso:Request><lasso:RemoteProviderID>https://sts.windows.net/6...t;</lasso:Login> samld_send_common_reply [123]: Attr: 11, 1062, https://login.microsofton...urTMUoBPVoAWJUSQ%3D%3D [270:root:5]Timeout for connection 0x7fa4aa5fbf00.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I am having a similar error. How did you get this resolved with GHIGH and SSL VPN?
FortiGate by default has a five second timeout for remote authentication (authentication against SAML, LDAP, RADIUS etc).
This can often cause issues when two-factor authentication is in play, as that typically takes more than five seconds to finish and report a successful authentication back to FortiGate.
You could try this setting:
(config global)
config system global
set remoteauthtimeout 60 ##this value is in seconds
end
If the issue persists, you can try gathering the sslvpn debug again with timestamps (dia de console timestamp en) to get a better understanding at what point FortiGate times out the connection.
EDIT: this setting does mean that in the case of connection issues to authentication servers, users might wait longer for FortiGate to report back a failure.
Hope this helps :)
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1662 | |
1077 | |
752 | |
446 | |
220 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.