SSLVPN not working

[H3nrikP]

Hi all

Have a strange problem with SSL VPN not answering. Have set it up multiple times on other system but only with only one WAN IP. Problem here i think is that it listens on all WAN IP's (11 Wan IPs). Everything is standard otherwise than the port (444) but the service doesn't answer. It's a FG81 running 7.2.5

Best regards

Henrik

[spoojary]

It will only listen to what wan IP you have configured on the FGT. What happens when you connect to the FCT ? What is the error and the percentage that would give us more info. 

[H3nrikP]

Hi there

No error message, just no answer from forticlient or https://IP:444

It is enabled on that port, but as you see in the list it listens on all interfaces. I tried to connect to all of them 

/Henrik

[srajeswaran]

Do you see the TCP SYN packet coming to firewall? Is firewall sending a RST?

Can you check if there is any local-in-olicy configured (config firewall local-in-policy)?

[H3nrikP]

Hi Suraj

Look in the thread, I have posted some stuff..

Regards

Henrik

[mle2802]

Hi there,

Can you please try to connect to VPN and run the following commands:
diag sniffer packet any "host X.X.X.X and port 444" 4 0 l (where X.X.X.X is public IP where you coming from)

Regards,
Minh

[H3nrikP]

Hi there.

The packets are arriving

[xshkurti]

@H3nrikP 
Can you do a packet sniffer on WAN  interface?
diag sniffer packet wan1 "host x.x.x.x port 444" 6 0 1     ----- where x.x.x.x is public IP of your client trying to connect with ssl vpn
to see the communication between host and fortigate.

Another good test would be to try to access web-mode on all IPs listed under WAN interface

[H3nrikP]

I did try them all :)

Regards

Henrik

[hbac]

Hi @H3nrikP, 

We see traffic on port 444 which means the ISP forwarded it to the FortiGate. Can you make sure there is no virtual IP configured on port 444? Please also make sure "source-address-negate" is not enabled. If it is enabled, the "source-address" must not be "all". You can run the following command to check: 
show full vpn ssl setting | grep source

Regards,