SSL VPN user cant login after AV check enabled

[Navs]

Hi, i have a pair of 100E Fortigate firewalls running 6.0.4.  I have created a new user group,DMWS_UserGroupAD, linked to AD and created a new SSL VPN portal,DMWS_Tunnel, and mapped the user group to the portalin SSL VPN settings. The user can logon fine, until i set the av host check on the tunnel and then the user gets an error 'Unable to logon to the server, your username and password may not be configured properly for this connection. (-12)'. If i remove the host check the user can logon fine again. I've even copied and pasted the password to make sure i am not making a typo. I have included the debug logs below, any help appreciated.  By the way i am using MCafee ENS 10.6.1 as the AV software and its fully up to date.

Config is

config vpn ssl web portal edit "DMWS_Tunnel" set tunnel-mode enable set web-mode enable [style="background-color: #ffff00;"] set host-check av[/style] set limit-user-logins enable set ip-pools "SSLVPN_TUNNEL_ADDR1" [size="1"] set split-tunneling-routing-address "zf-survey-za[multi]"[/size] set user-bookmark disable config bookmark-group edit "gui-bookmarks" next end set display-connection-tools disable next end

Debug Logs

[size="1"][206:root:8548]SSL state:before SSL initialization (137.221.136.83)[/size] [size="1"][206:root:8548]SSL state:before SSL initialization:DH lib(137.221.136.83)[/size] [size="1"][206:root:8548]SSL_accept failed, 5:(null)[/size] [size="1"][206:root:8548]Destroy sconn 0x35f34e00, connSize=2. (root)[/size] [size="1"][204:root:8572]allocSSLConn:281 sconn 0x35f15000 (0:root)[/size] [size="1"][204:root:8572]SSL state:before SSL initialization (137.221.136.83)[/size] [size="1"][204:root:8572]SSL state:before SSL initialization (137.221.136.83)[/size] [size="1"][204:root:8572]SSL state:SSLv3/TLS read client hello (137.221.136.83)[/size] [size="1"][204:root:8572]SSL state:SSLv3/TLS write server hello (137.221.136.83)[/size] [size="1"][204:root:8572]SSL state:SSLv3/TLS write certificate (137.221.136.83)[/size] [size="1"][204:root:8572]SSL state:SSLv3/TLS write key exchange (137.221.136.83)[/size] [size="1"][204:root:8572]SSL state:SSLv3/TLS write server done (137.221.136.83)[/size] [size="1"][204:root:8572]SSL state:SSLv3/TLS write server done:system lib(137.221.136.83)[/size] [size="1"][204:root:8572]SSL state:SSLv3/TLS write server done (137.221.136.83)[/size] [size="1"][204:root:8572]SSL state:SSLv3/TLS read client key exchange (137.221.136.83)[/size] [size="1"][204:root:8572]SSL state:SSLv3/TLS read change cipher spec (137.221.136.83)[/size] [size="1"][204:root:8572]SSL state:SSLv3/TLS read finished (137.221.136.83)[/size] [size="1"][204:root:8572]SSL state:SSLv3/TLS write session ticket (137.221.136.83)[/size] [size="1"][204:root:8572]SSL state:SSLv3/TLS write change cipher spec (137.221.136.83)[/size] [size="1"][204:root:8572]SSL state:SSLv3/TLS write finished (137.221.136.83)[/size] [size="1"][204:root:8572]SSL state:SSL negotiation finished successfully (137.221.136.83)[/size] [size="1"][204:root:8572]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384[/size] [size="1"][204:root:8572]req: /remote/info[/size] [size="1"][205:root:8527]allocSSLConn:281 sconn 0x35cd0e00 (0:root)[/size] [size="1"][205:root:8527]SSL state:before SSL initialization (137.221.136.83)[/size] [size="1"][205:root:8527]SSL state:before SSL initialization (137.221.136.83)[/size] [size="1"][205:root:8527]SSL state:SSLv3/TLS read client hello (137.221.136.83)[/size] [size="1"][205:root:8527]SSL state:SSLv3/TLS write server hello (137.221.136.83)[/size] [size="1"][205:root:8527]SSL state:SSLv3/TLS write certificate (137.221.136.83)[/size] [size="1"][205:root:8527]SSL state:SSLv3/TLS write key exchange (137.221.136.83)[/size] [size="1"][205:root:8527]SSL state:SSLv3/TLS write server done (137.221.136.83)[/size] [size="1"][205:root:8527]SSL state:SSLv3/TLS write server done:system lib(137.221.136.83)[/size] [size="1"][205:root:8527]SSL state:SSLv3/TLS write server done (137.221.136.83)[/size] [size="1"][205:root:8527]SSL state:SSLv3/TLS read client key exchange (137.221.136.83)[/size] [size="1"][205:root:8527]SSL state:SSLv3/TLS read change cipher spec (137.221.136.83)[/size] [size="1"][205:root:8527]SSL state:SSLv3/TLS read finished (137.221.136.83)[/size] [size="1"][205:root:8527]SSL state:SSLv3/TLS write session ticket (137.221.136.83)[/size] [size="1"][205:root:8527]SSL state:SSLv3/TLS write change cipher spec (137.221.136.83)[/size] [size="1"][205:root:8527]SSL state:SSLv3/TLS write finished (137.221.136.83)[/size] [size="1"][205:root:8527]SSL state:SSL negotiation finished successfully (137.221.136.83)[/size] [size="1"][205:root:8527]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384[/size] [size="1"][205:root:8527]req: /remote/login[/size] [size="1"][205:root:8527]rmt_web_auth_info_parser_common:439 no session id in auth info[/size] [size="1"][205:root:8527]rmt_web_get_access_cache:756 invalid cache, ret=4103[/size] [size="1"][204:root:8572]sslvpn_read_request_common,682, ret=-1 error=-1, sconn=0x35f15000.[/size] [size="1"][204:root:8572]Destroy sconn 0x35f15000, connSize=3. (root)[/size] [size="1"][206:root:8549]allocSSLConn:281 sconn 0x35f34e00 (0:root)[/size] [size="1"][206:root:8549]SSL state:before SSL initialization (137.221.136.83)[/size] [size="1"][206:root:8549]SSL state:before SSL initialization (137.221.136.83)[/size] [size="1"][206:root:8549]SSL state:SSLv3/TLS read client hello (137.221.136.83)[/size] [size="1"][206:root:8549]SSL state:SSLv3/TLS write server hello (137.221.136.83)[/size] [size="1"][206:root:8549]SSL state:SSLv3/TLS write certificate (137.221.136.83)[/size] [size="1"][206:root:8549]SSL state:SSLv3/TLS write key exchange (137.221.136.83)[/size] [size="1"][206:root:8549]SSL state:SSLv3/TLS write server done (137.221.136.83)[/size] [size="1"][206:root:8549]SSL state:SSLv3/TLS write server done:system lib(137.221.136.83)[/size] [size="1"][206:root:8549]SSL state:SSLv3/TLS write server done (137.221.136.83)[/size] [size="1"][206:root:8549]SSL state:SSLv3/TLS read client key exchange (137.221.136.83)[/size] [size="1"][206:root:8549]SSL state:SSLv3/TLS read change cipher spec (137.221.136.83)[/size] [size="1"][206:root:8549]SSL state:SSLv3/TLS read finished (137.221.136.83)[/size] [size="1"][206:root:8549]SSL state:SSLv3/TLS write session ticket (137.221.136.83)[/size] [size="1"][206:root:8549]SSL state:SSLv3/TLS write change cipher spec (137.221.136.83)[/size] [size="1"][206:root:8549]SSL state:SSLv3/TLS write finished (137.221.136.83)[/size] [size="1"][206:root:8549]SSL state:SSL negotiation finished successfully (137.221.136.83)[/size] [size="1"][206:root:8549]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384[/size] [size="1"][206:root:8549]req: /remote/logincheck[/size] [size="1"][206:root:8549]rmt_web_auth_info_parser_common:439 no session id in auth info[/size] [size="1"][206:root:8549]rmt_web_access_check:682 access failed, uri=[/remote/logincheck],ret=4103,[/size] [size="1"][206:root:8549]sslvpn_auth_check_usrgroup:1766 forming user/group list from policy.[/size] [size="1"][206:root:8549]sslvpn_auth_check_usrgroup:1808 got user (0) group (8:0).[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1436 validating with SSL VPN authentication rules (14), realm ().[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1484 checking rule 1 cipher.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1492 checking rule 1 realm.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1503 checking rule 1 source intf.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1524 checking rule 1 source address.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1614 rule 1 done, got user (0) group (1:0).[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1484 checking rule 2 cipher.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1492 checking rule 2 realm.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1503 checking rule 2 source intf.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1524 checking rule 2 source address.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1614 rule 2 done, got user (0) group (2:0).[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1484 checking rule 3 cipher.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1492 checking rule 3 realm.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1503 checking rule 3 source intf.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1524 checking rule 3 source address.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1614 rule 3 done, got user (0) group (3:0).[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1484 checking rule 4 cipher.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1492 checking rule 4 realm.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1503 checking rule 4 source intf.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1524 checking rule 4 source address.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1614 rule 4 done, got user (0) group (4:0).[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1484 checking rule 5 cipher.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1492 checking rule 5 realm.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1503 checking rule 5 source intf.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1524 checking rule 5 source address.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1614 rule 5 done, got user (0) group (5:0).[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1484 checking rule 6 cipher.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1492 checking rule 6 realm.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1503 checking rule 6 source intf.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1524 checking rule 6 source address.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1614 rule 6 done, got user (0) group (5:0).[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1484 checking rule 7 cipher.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1492 checking rule 7 realm.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1503 checking rule 7 source intf.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1524 checking rule 7 source address.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1614 rule 7 done, got user (0) group (5:0).[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1484 checking rule 8 cipher.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1492 checking rule 8 realm.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1503 checking rule 8 source intf.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1524 checking rule 8 source address.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1614 rule 8 done, got user (0) group (5:0).[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1484 checking rule 9 cipher.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1492 checking rule 9 realm.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1503 checking rule 9 source intf.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1524 checking rule 9 source address.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1614 rule 9 done, got user (0) group (5:0).[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1484 checking rule 10 cipher.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1492 checking rule 10 realm.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1503 checking rule 10 source intf.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1524 checking rule 10 source address.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1614 rule 10 done, got user (0) group (5:0).[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1484 checking rule 11 cipher.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1492 checking rule 11 realm.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1503 checking rule 11 source intf.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1524 checking rule 11 source address.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1614 rule 11 done, got user (0) group (6:0).[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1484 checking rule 12 cipher.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1492 checking rule 12 realm.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1503 checking rule 12 source intf.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1542 checking rule 12 vd source intf.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1614 rule 12 done, got user (0) group (6:0).[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1484 checking rule 14 cipher.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1492 checking rule 14 realm.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1503 checking rule 14 source intf.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1614 rule 14 done, got user (0) group (7:0).[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1484 checking rule 15 cipher.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1492 checking rule 15 realm.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1503 checking rule 15 source intf.[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1614 rule 15 done, got user (0) group (8:0).[/size] [size="1"][206:root:8549]sslvpn_validate_user_group_list:1702 got user (0), group (8:0).[/size] [size="1"][206:root:8549]two factor check for user1: off[/size] [size="1"][206:root:8549]sslvpn_authenticate_user:167 authenticate user: [user1][/size] [size="1"][206:root:8549]sslvpn_authenticate_user:174 create fam state[/size] [size="1"][206:root:8549]fam_auth_send_req:575 with server blacklist:[/size] [size="1"][206:root:8549]fam_auth_send_req_internal:453 fnbam_auth return: 4[/size] [size="1"][206:root:8549]Auth successful for group DMWS_UserGroupAD[/size] [size="1"][206:root:8549]fam_do_cb:479 fnbamd return auth success.[/size] [size="1"][206:root:8549]SSL VPN login matched rule (15).[/size] [size="1"][206:root:8549]rmt_web_session_create:709 create web session, idx[7][/size] [size="1"][206:root:8549]login_succeeded:383 redirect to hostcheck[/size] [size="1"][206:root:8549]deconstruct_session_id:378 decode session id ok, user=[user1],group=[DMWS_UserGroupAD],authserver=[CORP-ADroot],portal=[DMWS_Tunnel],host=[137.221.136.83],realm=[],idx=7,auth=16,sid=69b1c6ec, login=1572340686, access=1572340686[/size] [size="1"][206:root:8549]deconstruct_session_id:378 decode session id ok, user=[user1],group=[DMWS_UserGroupAD],authserver=[CORP-ADroot],portal=[DMWS_Tunnel],host=[137.221.136.83],realm=[],idx=7,auth=16,sid=69b1c6ec, login=1572340686, access=1572340686[/size] [size="1"][206:root:8549]deconstruct_session_id:378 decode session id ok, user=[user1],group=[DMWS_UserGroupAD],authserver=[CORP-ADroot],portal=[DMWS_Tunnel],host=[137.221.136.83],realm=[],idx=7,auth=16,sid=69b1c6ec, login=1572340686, access=1572340686[/size] [size="1"][206:root:8549]deconstruct_session_id:378 decode session id ok, user=[user1],group=[DMWS_UserGroupAD],authserver=[CORP-ADroot],portal=[DMWS_Tunnel],host=[137.221.136.83],realm=[],idx=7,auth=16,sid=69b1c6ec, login=1572340686, access=1572340686[/size] [size="1"][205:root:8527]sslvpn_read_request_common,682, ret=-1 error=-1, sconn=0x35cd0e00.[/size] [size="1"][205:root:8527]Destroy sconn 0x35cd0e00, connSize=3. (root)[/size] [size="1"][204:root:8573]allocSSLConn:281 sconn 0x35f15000 (0:root)[/size] [size="1"][204:root:8573]SSL state:before SSL initialization (137.221.136.83)[/size] [size="1"][204:root:8573]SSL state:before SSL initialization (137.221.136.83)[/size] [size="1"][204:root:8573]SSL state:SSLv3/TLS read client hello (137.221.136.83)[/size] [size="1"][204:root:8573]SSL state:SSLv3/TLS write server hello (137.221.136.83)[/size] [size="1"][204:root:8573]SSL state:SSLv3/TLS write certificate (137.221.136.83)[/size] [size="1"][204:root:8573]SSL state:SSLv3/TLS write key exchange (137.221.136.83)[/size] [size="1"][204:root:8573]SSL state:SSLv3/TLS write server done (137.221.136.83)[/size] [size="1"][204:root:8573]SSL state:SSLv3/TLS write server done:system lib(137.221.136.83)[/size] [size="1"][204:root:8573]SSL state:SSLv3/TLS write server done (137.221.136.83)[/size] [size="1"][204:root:8573]SSL state:SSLv3/TLS read client key exchange (137.221.136.83)[/size] [size="1"][204:root:8573]SSL state:SSLv3/TLS read change cipher spec (137.221.136.83)[/size] [size="1"][204:root:8573]SSL state:SSLv3/TLS read finished (137.221.136.83)[/size] [size="1"][204:root:8573]SSL state:SSLv3/TLS write session ticket (137.221.136.83)[/size] [size="1"][204:root:8573]SSL state:SSLv3/TLS write change cipher spec (137.221.136.83)[/size] [size="1"][204:root:8573]SSL state:SSLv3/TLS write finished (137.221.136.83)[/size] [size="1"][204:root:8573]SSL state:SSL negotiation finished successfully (137.221.136.83)[/size] [size="1"][204:root:8573]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384[/size] [size="1"][204:root:8573]req: /remote/fortisslvpn[/size] [size="1"][204:root:8573]deconstruct_session_id:378 decode session id ok, user=[user1],group=[DMWS_UserGroupAD],authserver=[CORP-ADroot],portal=[DMWS_Tunnel],host=[137.221.136.83],realm=[],idx=7,auth=16,sid=69b1c6ec, login=1572340686, access=1572340686[/size] [size="1"][204:root:8573]rmt_web_access_check:682 access failed, uri=[/remote/fortisslvpn],ret=4103,[/size] [size="1"][204:root:8573]req: /remote/login[/size] [size="1"][204:root:8573]rmt_web_auth_info_parser_common:439 no session id in auth info[/size] [size="1"][204:root:8573]rmt_web_get_access_cache:756 invalid cache, ret=4103[/size] [size="1"][206:root:8549]sslvpn_read_request_common,682, ret=-1 error=-1, sconn=0x35f34e00.[/size] [size="1"][206:root:8549]Destroy sconn 0x35f34e00, connSize=2. (root)[/size] [size="1"][205:root:8528]allocSSLConn:281 sconn 0x35cd0e00 (0:root)[/size] [size="1"][205:root:8528]SSL state:before SSL initialization (137.221.136.83)[/size] [size="1"][205:root:8528]SSL state:before SSL initialization (137.221.136.83)[/size] [size="1"][205:root:8528]SSL state:SSLv3/TLS read client hello (137.221.136.83)[/size] [size="1"][205:root:8528]SSL state:SSLv3/TLS write server hello (137.221.136.83)[/size] [size="1"][205:root:8528]SSL state:SSLv3/TLS write certificate (137.221.136.83)[/size] [size="1"][205:root:8528]SSL state:SSLv3/TLS write key exchange (137.221.136.83)[/size] [size="1"][205:root:8528]SSL state:SSLv3/TLS write server done (137.221.136.83)[/size] [size="1"][205:root:8528]SSL state:SSLv3/TLS write server done:system lib(137.221.136.83)[/size] [size="1"][205:root:8528]SSL state:SSLv3/TLS write server done (137.221.136.83)[/size] [size="1"][205:root:8528]SSL state:SSLv3/TLS read client key exchange (137.221.136.83)[/size] [size="1"][205:root:8528]SSL state:SSLv3/TLS read change cipher spec (137.221.136.83)[/size] [size="1"][205:root:8528]SSL state:SSLv3/TLS read finished (137.221.136.83)[/size] [size="1"][205:root:8528]SSL state:SSLv3/TLS write session ticket (137.221.136.83)[/size] [size="1"][205:root:8528]SSL state:SSLv3/TLS write change cipher spec (137.221.136.83)[/size] [size="1"][205:root:8528]SSL state:SSLv3/TLS write finished (137.221.136.83)[/size] [size="1"][205:root:8528]SSL state:SSL negotiation finished successfully (137.221.136.83)[/size] [size="1"][205:root:8528]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384[/size] [size="1"][205:root:8528]req: /FortiClientSslvpnClearCacheUrl/for/Wini[/size] [size="1"][205:root:8528]def: (nil) /FortiClientSslvpnClearCacheUrl/for/WininetLibrary/1/2/3/4/5/6/7/8/9/0/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t[/size] diagnose debug disable

[Navs]

Hi

Can anyone help?

thanks

[Navs]

For some strange reason, i had to downgrade to forticlient 6.0 in order to get the above to work with av host check. I was trying to use forticlient 6.2 but something to do with they way licencing has changed it would not work. Thought it might be useful for others.

[bmduncan34]

That is helpful for me, thanks.  We're looking to see how well FortiClient and McAfee ENS on our mobile endpoints work together. 

[Magion]

You are probably using the standalone/free FortiClient?

From https://kb.fortinet.com/kb/documentLink.do?externalID=FD48147:

The following features are not supported in the FortiClient 6.2.X free version: ... Host check features ...