SSL-VPN connects and disconnects straight away

[michael_lacey]

Hi All,

I have an SSL-VPN that did work, however now, users connect and straight away disconnect. I have ran a debug and obtained the following (full debug attached)

[4832:root:31266]tunnel_state.c:1278 no more addresses available

To me this suggests that the IP range for the SSL VPN is full? Currently though I do not have any users on the VPN, is there a way we can clear this?

Thanks

[Toshi_Esumi]

Although I don't see your attachment, my guess is about the same as yours for the log. Then I'm wondering what happened between the time "did work" and "now". Did you upgrade the system or change some SSL-VPN related config, or really nothing has happened?

[emnoc]

I had that same issue awhile back in v5.2.3 iirc and it didn't make any sense to me. What I did was to kill the  sslvpn process

Execute a kill against the proc-id

1st run a new diag debug 

diag debug application  sslvpn -1

2nd

fnsysctl cat /var/run/sslvpnd.pid

fnsysctl kill -9 <pid from above>

rerun and make sure a new pid comes up

3rd

fnsysctl cat /var/run/sslvpnd.pid

review any diagnostic output ;

reference

http://socpuppet.blogspot.com/2014/06/how-to-kill-dhcp-daemon-or-any-daemons.html

[Toshi_Esumi]

if a multi-vdom environment

    fnsysctl killall sslvpnd

then

    diag sys top-summary "-i 10"

would be handy.

[michael_lacey]

Thanks for the responses guys,

would blowing away the config and reentering it, or a reboot help in the first instance?

not totally comfortable with killing the process as Fortinet do not seem to support it?

Thanks

[emnoc]

You can do that  but killing the pid off is what the re-configuration would do also. If you don't want to use fnsyscl you can use  diag sys kill  <killnumber>  <pid#>

e.g

    diag sys kill  9 20032

Just make sure a new pid comes up and that would ensured you killed  off  the process.

Ken

[Toshi_Esumi]

And, that's what TAC would ask you to do or do it themselves when you open a ticket and don't find anything wrong in the config. It just affects to any ongoing SSL VPN sessions if anything is up, instead of affecting to everybody when you reboot the unit.

[vickylahkarbytes]

I do not know the Mac OS much, but in windows i solved the same problem the deleting the Fortissl connection in internet options of windows control panel.