Unlock Exclusive Benefits
Join Our Community Today!
Join our community and post in the forum to earn your exclusive Autumn 2024 badge! Become a member today!
LOGIN/REGISTER
CONTINUE AS A GUEST
- Forums
- Knowledge Base
- Customer Service
- Internal Article Nominations
- FortiGate
- FortiClient
- FortiAP
- FortiAnalyzer
- FortiADC
- FortiAuthenticator
- FortiBridge
- FortiCache
- FortiCarrier
- FortiCASB
- FortiConnect
- FortiConverter
- FortiCNP
- FortiDAST
- FortiDDoS
- FortiDB
- FortiDNS
- FortiDeceptor
- FortiDLP
- FortiDevSec
- FortiDirector
- FortiEDR
- FortiExtender
- FortiGuard
- FortiGate Cloud
- FortiHypervisor
- FortiInsight
- FortiIsolator
- FortiMail
- FortiMonitor
- FortiManager
- FortiNAC
- FortiNAC-F
- FortiNDR (on-premise)
- FortiNDRCloud
- FortiPAM
- FortiPhish
- FortiPortal
- FortiProxy
- FortiRecon
- FortiRecorder
- FortiSRA
- FortiSandbox
- FortiSASE
- FortiScan
- FortiSIEM
- FortiSOAR
- FortiSwitch
- FortiTester
- FortiToken
- FortiVoice
- FortiWAN
- FortiWeb
- FortiWebCloud
- Lacework
- Wireless Controller
- RMA Information and Announcements
- FortiCloud Products
- ZTNA
- 4D Documents
- Customer Service
- Community Groups
- Blogs
Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
- Fortinet Community
- Forums
- Support Forum
- Re: SSL VPN for MAC M1 MAX
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SSL VPN for MAC M1 MAX
I'm able to connect on my iPhone but not from my Mac here is the logs.
20240411 10:40:51 TZ=-0400 [VPN:INFO] PacketTunnelProvider.swift:42 VPN provider: 0850
20240411 10:40:51 TZ=-0400 [VPN:INFO] PacketTunnelProvider.swift:56 Start Destination IP tunnel.
20240411 10:40:51 TZ=-0400 [VPN:DEBG] PacketTunnelProvider.swift:148 Mode: 0
20240411 10:40:51 TZ=-0400 [VPN:DEBG] SystemConfig.swift:212 Get DNS from Setup domain
20240411 10:40:51 TZ=-0400 [VPN:DEBG] SystemConfig.swift:242 Copy service entity failed
20240411 10:40:51 TZ=-0400 [VPN:DEBG] SystemConfig.swift:212 Get DNS from State domain
20240411 10:40:51 TZ=-0400 [VPN:INFO] SSLVPNTunnel.swift:1111 Starting TLS tunnel
20240411 10:40:51 TZ=-0400 [VPN:DEBG] SSLVPNTunnel.swift:1117 Hostname: ------
20240411 10:40:51 TZ=-0400 [VPN:INFO] SSLVPNTunnel.swift:1052 TLS tunnel connection state: PREPARING
20240411 10:40:51 TZ=-0400 [VPN:DEBG] SSLVPNTunnel.swift:1016 TLS tunnel connection state: READY
20240411 10:40:51 TZ=-0400 [VPN:DEBG] SSLVPNTunnel.swift:1017 remote IP: -------
20240411 10:40:51 TZ=-0400 [VPN:EROR] SSLVPNTunnel.swift:196 Server does not support all known tunnel methods.
20240411 10:40:51 TZ=-0400 [VPN:INFO] SSLVPNTunnel.swift:1039 TLS tunnel connection state: CANCELLED
20240411 10:40:51 TZ=-0400 [VPN:EROR] SSLVPNTunnel.swift:1045 TLS tunnel cancelled with error: badConfiguration
20240411 10:40:51 TZ=-0400 [VPN:EROR] SSLVPNTunnel.swift:838 Closed while starting, with error: badConfiguration
Related issue: https://community.fortinet.com/t5/Support-Forum/SSL-VPN-Windows-Works-MacOS-does-not/m-p/47900
I have tried all the suggestions from that thread. I'm on an Apple M1 Max and getting this with Forticlient 7.2.4.0850 which is the client my firewall is serving when I go to download it.
Labels:
- Labels:
-
FortiGate v5.4
-
SSL-VPN
Nominate a Forum Post for Knowledge Article Creation
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
13 REPLIES 13
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@bustedware , could you enable some debugs on FGT side, and reproduce the issue, then share outputs here:
What is you FGT version btw?
diag debug reset
diag debug console timestamp enable
diag debug app fnbamd -1
diag debug app sslvpn -1
diagnose debug enable
Asset
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes. Can you please let me know how do I rollback these changes first and where will the logs be generated on the firewall? Thank you
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sure,
open ssh connection to FGT, and execute these commands above.
after finishing, disable the debugs using the command below, and share outputs:
diag de disable
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-Troubleshooting/ta-p/189542
Asset
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here is the log after reproducing the issue:
2024-04-11 08:31:23 [139:root:30]allocSSLConn:264 sconn 0x54519300 (0:root)
2024-04-11 08:31:23 [139:root:30]SSL state:before/accept initialization (172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSLv3 read client hello A (172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSLv3 write server hello A (172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSLv3 write certificate A (172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSLv3 write key exchange A (172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSLv3 write server done A (172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSLv3 flush data (172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSLv3 read client certificate A (172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSLv3 read client key exchange A:system lib(172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSLv3 read client key exchange A:system lib(172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSLv3 read client key exchange A (172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSLv3 read certificate verify A (172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSLv3 read finished A (172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSLv3 write change cipher spec A (172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSLv3 write finished A (172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSLv3 flush data (172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL state:SSL negotiation finished successfully (172.20.30.106)
2024-04-11 08:31:23 [139:root:30]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
2024-04-11 08:31:23 [139:root:30]req: /remote/info
2024-04-11 08:31:23 [139:root:30]sslConnGotoNextState:297 error (last state: 1, closeOp: 0)
2024-04-11 08:31:23 [139:root:30]Destroy sconn 0x54519300, connSize=0. (root)
2024-04-11 08:31:23 [139:root:31]allocSSLConn:264 sconn 0x54519300 (0:root)
2024-04-11 08:31:23 [139:root:31]SSL state:before/accept initialization (172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSLv3 read client hello A (172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSLv3 write server hello A (172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSLv3 write certificate A (172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSLv3 write key exchange A (172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSLv3 write server done A (172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSLv3 flush data (172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSLv3 read client certificate A (172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSLv3 read client key exchange A:system lib(172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSLv3 read client key exchange A:system lib(172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSLv3 read client key exchange A (172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSLv3 read certificate verify A (172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSLv3 read finished A (172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSLv3 write change cipher spec A (172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSLv3 write finished A (172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSLv3 flush data (172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL state:SSL negotiation finished successfully (172.20.30.106)
2024-04-11 08:31:23 [139:root:31]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
2024-04-11 08:31:23 [139:root:31]req: /remote/login
2024-04-11 08:31:23 [139:root:31]rmt_web_auth_info_parser_common:418 no session id in auth info
2024-04-11 08:31:23 [139:root:31]rmt_web_get_access_cache:729 invalid cache, ret=4103
2024-04-11 08:31:23 [139:root:31]sslConnGotoNextState:297 error (last state: 1, closeOp: 0)
2024-04-11 08:31:23 [139:root:31]Destroy sconn 0x54519300, connSize=0. (root)
2024-04-11 08:31:23 [139:root:32]allocSSLConn:264 sconn 0x54519300 (0:root)
2024-04-11 08:31:23 [139:root:32]SSL state:before/accept initialization (172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSLv3 read client hello A (172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSLv3 write server hello A (172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSLv3 write certificate A (172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSLv3 write key exchange A (172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSLv3 write server done A (172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSLv3 flush data (172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSLv3 read client certificate A (172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSLv3 read client key exchange A:system lib(172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSLv3 read client key exchange A:system lib(172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSLv3 read client key exchange A (172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSLv3 read certificate verify A (172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSLv3 read finished A (172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSLv3 write change cipher spec A (172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSLv3 write finished A (172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSLv3 flush data (172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL state:SSL negotiation finished successfully (172.20.30.106)
2024-04-11 08:31:23 [139:root:32]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
2024-04-11 08:31:23 [139:root:32]req: /remote/logincheck
2024-04-11 08:31:23 [139:root:32]rmt_web_auth_info_parser_common:418 no session id in auth info
2024-04-11 08:31:23 [139:root:32]rmt_web_access_check:667 access failed, uri=[/remote/logincheck],ret=4103,
2024-04-11 08:31:23 [139:root:32]rmt_logincheck_cb_handler:861 user 'bustedware' has a matched local entry.
2024-04-11 08:31:23 [139:root:32]sslvpn_auth_check_usrgroup:1752 forming user/group list from policy.
2024-04-11 08:31:23 [139:root:32]sslvpn_auth_check_usrgroup:1790 got user (0) group (1:0).
2024-04-11 08:31:23 [139:root:32]sslvpn_validate_user_group_list:1423 validating with SSL VPN authentication rules (1), realm ().
2024-04-11 08:31:23 [139:root:32]sslvpn_validate_user_group_list:1471 checking rule 1 cipher.
2024-04-11 08:31:23 [139:root:32]sslvpn_validate_user_group_list:1479 checking rule 1 realm.
2024-04-11 08:31:23 [139:root:32]sslvpn_validate_user_group_list:1490 checking rule 1 source intf.
2024-04-11 08:31:23 [139:root:32]sslvpn_validate_user_group_list:1527 checking rule 1 vd source intf.
2024-04-11 08:31:23 [139:root:32]sslvpn_validate_user_group_list:1600 rule 1 done, got user (0) group (1:0).
2024-04-11 08:31:23 [139:root:32]sslvpn_validate_user_group_list:1688 got user (0), group (1:0).
2024-04-11 08:31:23 [139:root:32]two factor check for bustedware: off
2024-04-11 08:31:23 [139:root:32]sslvpn_authenticate_user:168 authenticate user: [bustedware]
2024-04-11 08:31:23 [139:root:32]sslvpn_authenticate_user:175 create fam state
2024-04-11 08:31:23 [139:root:32]fam_auth_send_req:528 with server blacklist:
2024-04-11 08:31:23 [139:root:32]fam_auth_send_req_internal:416 fnbam_auth return: 0
2024-04-11 08:31:23 [139:root:32]fam_auth_send_req_internal:422 authentication OK
2024-04-11 08:31:23 [139:root:32]fam_do_cb:471 fnbamd return auth success.
2024-04-11 08:31:23 [139:root:32]SSL VPN login matched rule (1).
2024-04-11 08:31:23 [139:root:32]login_succeeded:383 redirect to hostcheck
2024-04-11 08:31:23 [139:root:32]deconstruct_session_id:363 decode session id ok, user=[bustedware],group=[IPSEC-VPN],portal=[tunnel-access],host=[172.20.30.106],realm=[],idx=0,auth=1,sid=4c5947be, login=1712849483, access=1712849483
2024-04-11 08:31:23 [139:root:32]deconstruct_session_id:363 decode session id ok, user=[bustedware],group=[IPSEC-VPN],portal=[tunnel-access],host=[172.20.30.106],realm=[],idx=0,auth=1,sid=4c5947be, login=1712849483, access=1712849483
2024-04-11 08:31:23 [139:root:32]deconstruct_session_id:363 decode session id ok, user=[bustedware],group=[IPSEC-VPN],portal=[tunnel-access],host=[172.20.30.106],realm=[],idx=0,auth=1,sid=4c5947be, login=1712849483, access=1712849483
2024-04-11 08:31:23 [139:root:32]sslConnGotoNextState:297 error (last state: 1, closeOp: 0)
2024-04-11 08:31:23 [139:root:32]Destroy sconn 0x54519300, connSize=0. (root)
2024-04-11 08:31:23 [139:root:33]allocSSLConn:264 sconn 0x54519300 (0:root)
2024-04-11 08:31:23 [139:root:33]SSL state:before/accept initialization (172.20.30.106)
2024-04-11 08:31:23 [139:root:33]SSL state:SSLv3 read client hello A (172.20.30.106)
2024-04-11 08:31:23 [139:root:33]SSL state:SSLv3 write server hello A (172.20.30.106)
2024-04-11 08:31:23 [139:root:33]SSL state:SSLv3 write change cipher spec A (172.20.30.106)
2024-04-11 08:31:23 [139:root:33]SSL state:SSLv3 write finished A (172.20.30.106)
2024-04-11 08:31:23 [139:root:33]SSL state:SSLv3 flush data (172.20.30.106)
2024-04-11 08:31:23 [139:root:33]SSL state:SSLv3 read finished A:system lib(172.20.30.106)
2024-04-11 08:31:23 [139:root:33]SSL state:SSLv3 read finished A:system lib(172.20.30.106)
2024-04-11 08:31:23 [139:root:33]SSL state:SSLv3 read finished A (172.20.30.106)
2024-04-11 08:31:23 [139:root:33]SSL state:SSL negotiation finished successfully (172.20.30.106)
2024-04-11 08:31:23 [139:root:33]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
2024-04-11 08:31:23 [139:root:33]req: /remote/fortisslvpn
2024-04-11 08:31:23 [139:root:33]deconstruct_session_id:363 decode session id ok, user=[bustedware],group=[IPSEC-VPN],portal=[tunnel-access],host=[172.20.30.106],realm=[],idx=0,auth=1,sid=4c5947be, login=1712849483, access=1712849483
2024-04-11 08:31:23 [139:root:33]deconstruct_session_id:363 decode session id ok, user=[bustedware],group=[IPSEC-VPN],portal=[tunnel-access],host=[172.20.30.106],realm=[],idx=0,auth=1,sid=4c5947be, login=1712849483, access=1712849483
2024-04-11 08:31:23 [139:root:33]form_ipv4_split_tunnel_addr:1499 Matched policy (id = 13) to add split tunnel routing address
2024-04-11 08:31:23 [139:root:33]sslConnGotoNextState:297 error (last state: 1, closeOp: 0)
2024-04-11 08:31:23 [139:root:33]Destroy sconn 0x54519300, connSize=0. (root)
2024-04-11 08:31:23 [139:root:34]allocSSLConn:264 sconn 0x54519300 (0:root)
2024-04-11 08:31:23 [139:root:34]SSL state:before/accept initialization (172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSLv3 read client hello A (172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSLv3 write server hello A (172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSLv3 write certificate A (172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSLv3 write key exchange A (172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSLv3 write server done A (172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSLv3 flush data (172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSLv3 read client certificate A (172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSLv3 read client key exchange A:system lib(172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSLv3 read client key exchange A:system lib(172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSLv3 read client key exchange A (172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSLv3 read certificate verify A (172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSLv3 read finished A (172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSLv3 write change cipher spec A (172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSLv3 write finished A (172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSLv3 flush data (172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL state:SSL negotiation finished successfully (172.20.30.106)
2024-04-11 08:31:23 [139:root:34]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
2024-04-11 08:31:23 [139:root:34]req: /remote/fortisslvpn_xml
2024-04-11 08:31:23 [139:root:34]deconstruct_session_id:363 decode session id ok, user=[bustedware],group=[IPSEC-VPN],portal=[tunnel-access],host=[172.20.30.106],realm=[],idx=0,auth=1,sid=4c5947be, login=1712849483, access=1712849483
2024-04-11 08:31:23 [139:root:34]deconstruct_session_id:363 decode session id ok, user=[bustedware],group=[IPSEC-VPN],portal=[tunnel-access],host=[172.20.30.106],realm=[],idx=0,auth=1,sid=4c5947be, login=1712849483, access=1712849483
2024-04-11 08:31:23 [139:root:34]sslvpn_reserve_dynip:1077 tunnel vd[root] ip[10.212.134.200]
2024-04-11 08:31:23 [139:root:34]form_ipv4_split_tunnel_addr:1499 Matched policy (id = 13) to add split tunnel routing address
2024-04-11 08:31:23 [139:root:34]sslConnGotoNextState:297 error (last state: 1, closeOp: 0)
2024-04-11 08:31:23 [139:root:34]Destroy sconn 0x54519300, connSize=0. (root)
2024-04-11 08:31:25 [139:root:35]allocSSLConn:264 sconn 0x54596800 (0:root)
2024-04-11 08:31:25 [139:root:35]DTLS state:before/accept initialization (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 read client hello A (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:DTLS1 write hello verify request A (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 flush data (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 read client hello B:system lib(172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 read client hello B (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 write server hello A (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 write certificate A (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 write key exchange A (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 write server done A (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 flush data (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 read client certificate A (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 read client key exchange A:system lib(172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 read client key exchange A (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 read certificate verify A (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 read finished A (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 write session ticket A (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 write change cipher spec A (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 write finished A (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSLv3 flush data (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS state:SSL negotiation finished successfully (172.20.30.106)
2024-04-11 08:31:25 [139:root:35]DTLS established: DTLSv1 ECDHE-RSA-AES256-GCM-SHA384 from 172.20.30.106
2024-04-11 08:31:25 [139:root:35]sslvpn_dtls_handle_client_data:630 got type clthello-tun
2024-04-11 08:31:25 [139:root:35]sslvpn_send_ctrl_msg:873 0x54596800 message: svrhello fail 172.20.30.106
2024-04-11 08:31:25 [139:root:35]Destroy sconn 0x54596800, connSize=0. (root)
2024-04-11 08:31:25 [139:root:36]allocSSLConn:264 sconn 0x54596800 (0:root)
2024-04-11 08:31:25 [139:root:36]DTLS state:before/accept initialization (172.20.30.106)
2024-04-11 08:31:25 [139:root:36]DTLS state:SSLv3 read client hello B:system lib(172.20.30.106)
2024-04-11 08:31:25 [139:root:37]allocSSLConn:264 sconn 0x54519900 (0:root)
2024-04-11 08:31:25 [139:root:37]SSL state:before/accept initialization (172.20.30.106)
2024-04-11 08:31:25 [139:root:37]SSL state:SSLv3 read client hello A (172.20.30.106)
2024-04-11 08:31:25 [139:root:37]SSL state:SSLv3 write server hello A (172.20.30.106)
2024-04-11 08:31:25 [139:root:37]SSL state:SSLv3 write certificate A (172.20.30.106)
2024-04-11 08:31:25 [139:root:37]SSL state:SSLv3 write key exchange A (172.20.30.106)
2024-04-11 08:31:25 [139:root:37]SSL state:SSLv3 write server done A (172.20.30.106)
2024-04-11 08:31:25 [139:root:37]SSL state:SSLv3 flush data (172.20.30.106)
2024-04-11 08:31:25 [139:root:37]SSL state:SSLv3 read client certificate A (172.20.30.106)
2024-04-11 08:31:25 [139:root:37]SSL state:SSLv3 read client key exchange A:system lib(172.20.30.106)
2024-04-11 08:31:25 [139:root:37]SSL state:SSLv3 read client key exchange A:system lib(172.20.30.106)
2024-04-11 08:31:26 [139:root:37]SSL state:SSLv3 read client key exchange A (172.20.30.106)
2024-04-11 08:31:26 [139:root:37]SSL state:SSLv3 read certificate verify A (172.20.30.106)
2024-04-11 08:31:26 [139:root:37]SSL state:SSLv3 read finished A (172.20.30.106)
2024-04-11 08:31:26 [139:root:37]SSL state:SSLv3 write session ticket A (172.20.30.106)
2024-04-11 08:31:26 [139:root:37]SSL state:SSLv3 write change cipher spec A (172.20.30.106)
2024-04-11 08:31:26 [139:root:37]SSL state:SSLv3 write finished A (172.20.30.106)
2024-04-11 08:31:26 [139:root:37]SSL state:SSLv3 flush data (172.20.30.106)
2024-04-11 08:31:26 [139:root:37]SSL state:SSL negotiation finished successfully (172.20.30.106)
2024-04-11 08:31:26 [139:root:37]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
2024-04-11 08:31:26 [139:root:37]req: /remote/sslvpn-tunnel2?uuid=3EE24DA240A35639BD3782F753547C08
2024-04-11 08:31:26 [139:root:37]def: (nil) /remote/sslvpn-tunnel2
2024-04-11 08:31:26 [139:root:37]req:
2024-04-11 08:31:26 [139:root:37]Invalid method in request .
2024-04-11 08:31:26 [139:root:37]sslConnGotoNextState:297 error (last state: 1, closeOp: 0)
2024-04-11 08:31:26 [139:root:37]Destroy sconn 0x54519900, connSize=1. (root)
2024-04-11 08:31:34 [139:root:0]sslvpn_internal_remove_one_web_session:2607 session (root:bustedware:IPSEC-VPN:172.20.30.106 1) removed for tunnel connection setup timeout for SSLVPN Client
2024-04-11 08:31:40 [139:root:36]sslvpn_dtls_timeout_check:286 waiting for client hello timeout.
2024-04-11 08:31:40 [139:root:36]Destroy sconn 0x54596800, connSize=0. (root)
Created on 04-12-2024 01:13 AM Edited on 04-12-2024 01:15 AM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I suspect there is an issue with Fclient side, because FGT successfully authenticated user, and reserved IP address.
2024-04-11 08:31:23 [139:root:32]fam_do_cb:471 fnbamd return auth success.
2024-04-11 08:31:23 [139:root:32]SSL VPN login matched rule (1).
2024-04-11 08:31:23 [139:root:32]login_succeeded:383 redirect to hostcheck
......
......
2024-04-11 08:31:23 [139:root:34]sslvpn_reserve_dynip:1077 tunnel vd[root] ip[10.212.134.200]
2024-04-11 08:31:23 [139:root:34]form_ipv4_split_tunnel_addr:1499 Matched policy (id = 13) to add split tunnel routing address
2024-04-11 08:31:23 [139:root:34]sslConnGotoNextState:297 error (last state: 1, closeOp: 0)
2024-04-11 08:31:23 [139:root:34]Destroy sconn 0x54519300, connSize=0. (root)
2024-04-11 08:31:25 [139:root:35]allocSSLConn:264 sconn 0x54596800 (0:root)I would suggest you test with downgrading your FortiClient version.
Asset
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @bustedware,
Error says bad configuration "TLS tunnel cancelled with error: badConfiguration". Can you share the configuration of the SSLVPN connection on FortiClient?
Regards,
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you using FQDN or IP address as Remote Gateway? If you have Host Check enabled on the firewall, try disabling it and see if you are able to connect. 5.4.4 is too old, is it possible to upgrade the firmware version?
Regards,
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No I can't upgrade the firmware or even downgrade for that matter. I bought this off ebay and can't register to my account. Who on earth puts firmware behind registration?!?!
Announcements
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
Related Posts
- Fortigate 50E 3 Views
- Issues with FortiClient EMS on macOS 28 Views
- VDOM setup or FortiManager setup 29 Views
- Threat feed via web proxy 32 Views
- Please, please, add metavariable support to... 35 Views
Labels
-
FortiGate
8,341 -
FortiClient
1,686 -
5.2
801 -
FortiManager
703 -
5.4
639 -
FortiAnalyzer
532 -
FortiSwitch
452 -
FortiAP
446 -
6.0
416 -
FortiClient EMS
392 -
5.6
362 -
FortiMail
307 -
6.2
251 -
FortiAuthenticator v5.5
234 -
SSL-VPN
205 -
5.0
196 -
FortiWeb
194 -
IPsec
174 -
FortiNAC
171 -
FortiGuard
132 -
6.4
128 -
SD-WAN
102 -
FortiGateCloud
100 -
FortiSIEM
97 -
FortiCloud Products
95 -
FortiToken
88 -
FortiAuthenticator
80 -
Customer Service
76 -
Wireless Controller
76 -
Firewall policy
67 -
4.0MR3
64 -
FortiProxy
56 -
FortiADC
51 -
Fortivoice
50 -
FortiEDR
50 -
High Availability
48 -
vlan
47 -
ZTNA
45 -
FortiSandbox
43 -
FortiExtender
43 -
FortiDNS
42 -
Routing
39 -
DNS
38 -
BGP
37 -
LDAP
37 -
FortiGate v5.4
35 -
FortiSwitch v6.4
34 -
SAML
32 -
Certificate
32 -
Interface
31 -
NAT
30 -
Authentication
29 -
SSO
29 -
FortiConnect
28 -
RADIUS
27 -
FortiLink
26 -
FortiWAN
25 -
FortiConverter
25 -
FortiGate v5.2
24 -
VDOM
24 -
Web profile
23 -
Application control
22 -
Virtual IP
22 -
Logging
21 -
Fortigate Cloud
19 -
FortiSwitch v6.2
18 -
FortiPortal
18 -
FortiMonitor
18 -
FortiPAM
18 -
SSL SSH inspection
18 -
Traffic shaping
17 -
FortiDDoS
15 -
FortiGate v5.0
14 -
OSPF
14 -
IP address management - IPAM
14 -
SSID
13 -
Static route
13 -
WAN optimization
13 -
FortiCASB
12 -
SNMP
12 -
Automation
12 -
Admin
12 -
System settings
12 -
Web application firewall profile
12 -
FortiManager v5.0
11 -
FortiSOAR
11 -
FortiManager v4.0
10 -
FortiRecorder
10 -
IPS signature
10 -
4.0MR2
9 -
FortiGate v4.0 MR3
9 -
FortiWeb v5.0
9 -
FortiAP profile
9 -
Proxy policy
9 -
FortiBridge
8 -
RMA Information and Announcements
8 -
Security profile
8 -
Port policy
8 -
4.0
7 -
FortiDeceptor
7 -
FortiAnalyzer v5.0
7 -
Traffic shaping policy
7 -
Fabric connector
7 -
Intrusion prevention
7 -
FortiCache
6 -
DNS filter
6 -
trunk
6 -
Packet capture
6 -
Antivirus profile
6 -
FortiCarrier
5 -
FortiToken Cloud
5 -
FortiTester
5 -
Users
5 -
Traffic shaping profile
5 -
Web rating
5 -
Fortinet Engage Partner Program
5 -
3.6
4 -
FortiScan
4 -
Explicit proxy
4 -
FortiDirector
4 -
Internet service database
4 -
Application signature
4 -
DLP sensor
4 -
Email filter profile
4 -
Netflow
4 -
Replacement messages
4 -
FortiDB
3 -
FortiHypervisor
3 -
API
3 -
FortiNDR
3 -
NAC policy
3 -
DLP Dictionary
3 -
DLP profile
3 -
DoS policy
3 -
VoIP profile
3 -
Multicast routing
3 -
FortiInsight
2 -
FortiAI
2 -
Kerberos
2 -
Authentication rule and scheme
2 -
Protocol option
2 -
Schedule
2 -
SDN connector
2 -
Service
2 -
Zone
2 -
Cloud Management Security
2 -
4.0MR1
1 -
FortiManager-VM
1 -
FortiCWP
1 -
Subscription Renewal Policy
1 -
Video Filter
1 -
TACACS
1 -
Multicast policy
1 -
Vulnerability Management
1
Top Kudoed Authors
| User | Count |
|---|---|
| 1632 | |
| 1063 | |
| 749 | |
| 443 | |
| 210 |
Broad. Integrated. Automated.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Security Research
Company
News & Articles
Copyright 2024 Fortinet, Inc. All Rights Reserved.