SSL vpn to vlan implicit deny

[tyrsofrage]

Ive been trying at this for awhile and cant wrap my head around the problem. 

Im trying to go from ssl vpn to vlan100 (ADMINS).

Fortigate sees vlan100 in the routing table.

It has a firewall policy allowing it. 

yet the policy match tool and debug shows it going to the implicit deny policy

What else am I missing?

[tyrsofrage]

debug output

[pminarik]

The policy demands an authenticated user - are they listed in the table of authed users?

> diag firewall auth list

=> find the username, check if it has the right IP