User Facing SSL VPN Disconnection Issue After 30 Seconds

[Azarudeen]

H Everyone,

One of our office users is experiencing an SSL VPN disconnection issue. After a successful login, the VPN disconnects automatically within 30 seconds.

The FortiGate device is functioning as the VPN server and is running FortiOS version 7.2.11. The user is using FortiClient version 7.2.8 on a Windows 11 PC.

Interestingly, the same user has another SSL VPN connection configured on the same laptop, and that connection is working fine.

At this point, I also suspect the issue might be related to the user’s laptop.

We are actively looking for a solution, so if you have encountered a similar issue before, your insights would be appreciated.

Regards,
Azarudeen

[AEK]

Hi Azarudeen

• Does it happen when a Windows 10 laptop connects to the same VPN server?
• Did you try with FortiClient 7.2.10 and 7.4.3?

You may also check SSL VPN logs on FG to see if some useful log is displayed when the issue occurs.

You can also try debug it on FG side to see what is shown when disconnection occurs:

diagnose vpn ssl debug-filter src-addr4 x.x.x.x
diagnose debug application sslvpn -1
diagnose debug enable

Hope it helps.

[Azarudeen]

Hi @AEK ,

• Does it happen when a Windows 10 laptop connects to the same VPN server?
  It happens sometimes. Not much as mentioned in this case.
• Did you try with FortiClient 7.2.10 and 7.4.3?
  I didn't tried. Let me try both versions. Could you please tell us what is the difference between these versions.
  
  Please find the debug command for reference,
  

  
  HCCIFWL300630 # diagnose debug dis

  HCCIFWL300630 #
  HCCIFWL300630 # diagnose debug reset

  HCCIFWL300630 # diagnose vpn ssl debug-filter src-addr4 103.152.x.x

  HCCIFWL300630 # diagnose debug application sslvpn -1
  Debug messages will be on for 30 minutes.

  HCCIFWL300630 # diagnose debug application tvc -1
  Debug messages will be on for 30 minutes.

  HCCIFWL300630 #
  HCCIFWL300630 # diagnose debug console timestamp enable

  HCCIFWL300630 #
  HCCIFWL300630 # diagnose debug enable

  HCCIFWL300630 # 2025-06-16 08:45:38 [178:root:430c1]allocSSLConn:310 sconn 0x7fd4c4d13800 (0:root)
  2025-06-16 08:45:38 [178:root:430c1]SSL state:before SSL initialization (103.152.x.x)
  2025-06-16 08:45:38 [178:root:430c1]SSL state:fatal decode error (103.152.x.x)
  2025-06-16 08:45:38 [178:root:430c1]SSL state:error:(null)(103.152.x.x)
  2025-06-16 08:45:38 [178:root:430c1]SSL_accept failed, 1:unexpected eof while reading
  2025-06-16 08:45:38 [178:root:430c1]Destroy sconn 0x7fd4c4d13800, connSize=10. (root)
  2025-06-16 08:45:39 [178:root:430c2]allocSSLConn:310 sconn 0x7fd4c4d13800 (0:root)
  2025-06-16 08:45:39 [178:root:430c2]SSL state:before SSL initialization (103.152.x.x)
  2025-06-16 08:45:39 [178:root:430c2]SSL state:fatal decode error (103.152.x.x)
  2025-06-16 08:45:39 [178:root:430c2]SSL state:error:(null)(103.152.x.x)
  2025-06-16 08:45:39 [178:root:430c2]SSL_accept failed, 1:unexpected eof while reading
  2025-06-16 08:45:39 [178:root:430c2]Destroy sconn 0x7fd4c4d13800, connSize=10. (root)
  2025-06-16 08:45:40 [178:root:430c3]allocSSLConn:310 sconn 0x7fd4c4d13800 (0:root)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:before SSL initialization (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:before SSL initialization (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]got SNI server name: gateway.xxx.xxx realm (null)
  2025-06-16 08:45:40 [178:root:430c3]client cert requirement: no
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS read client hello (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS write server hello (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS write change cipher spec (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 early data (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 early data:(null)(103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 early data (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]got SNI server name: gateway.xxx.xxx realm (null)
  2025-06-16 08:45:40 [178:root:430c3]client cert requirement: no
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS read client hello (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS write server hello (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 write encrypted extensions (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS write certificate (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 write server certificate verify (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS write finished (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 early data (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 early data:(null)(103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 early data (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS read finished (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS write session ticket (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS write session ticket (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384
  2025-06-16 08:45:40 [178:root:430c3]SSL state:fatal decode error (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]sslvpn_read_request_common,860, ret=-1 error=-1, sconn=0x7fd4c4d13800.
  2025-06-16 08:45:40 [178:root:430c3]Destroy sconn 0x7fd4c4d13800, connSize=10. (root)
  
  Regards,
  Azarudeen

•  

[Azarudeen]

 Hi @AEK ,

Thanks for the response.

• Does it happen when a Windows 10 laptop connects to the same VPN server?
  It happens sometimes, Not frequently as like this case
• Did you try with FortiClient 7.2.10 and 7.4.3?
  I still didn't tried. Let me try both versions. Could you please explain what is the difference between these versions.
  I have executed debug command for this issue. I have shared the log file for the reference.
  Kindly check and share your inputs. 
  
  

  
  HCCIFWL300630 # diagnose debug dis

  HCCIFWL300630 #
  HCCIFWL300630 # diagnose debug reset

  HCCIFWL300630 # diagnose vpn ssl debug-filter src-addr4 103.152.x.x

  HCCIFWL300630 # diagnose debug application sslvpn -1
  Debug messages will be on for 30 minutes.

  HCCIFWL300630 # diagnose debug application tvc -1
  Debug messages will be on for 30 minutes.

  HCCIFWL300630 #
  HCCIFWL300630 # diagnose debug console timestamp enable

  HCCIFWL300630 #
  HCCIFWL300630 # diagnose debug enable

  HCCIFWL300630 # 2025-06-16 08:45:38 [178:root:430c1]allocSSLConn:310 sconn 0x7fd4c4d13800 (0:root)
  2025-06-16 08:45:38 [178:root:430c1]SSL state:before SSL initialization (103.152.x.x)
  2025-06-16 08:45:38 [178:root:430c1]SSL state:fatal decode error (103.152.x.x)
  2025-06-16 08:45:38 [178:root:430c1]SSL state:error:(null)(103.152.x.x)
  2025-06-16 08:45:38 [178:root:430c1]SSL_accept failed, 1:unexpected eof while reading
  2025-06-16 08:45:38 [178:root:430c1]Destroy sconn 0x7fd4c4d13800, connSize=10. (root)
  2025-06-16 08:45:39 [178:root:430c2]allocSSLConn:310 sconn 0x7fd4c4d13800 (0:root)
  2025-06-16 08:45:39 [178:root:430c2]SSL state:before SSL initialization (103.152.x.x)
  2025-06-16 08:45:39 [178:root:430c2]SSL state:fatal decode error (103.152.x.x)
  2025-06-16 08:45:39 [178:root:430c2]SSL state:error:(null)(103.152.x.x)
  2025-06-16 08:45:39 [178:root:430c2]SSL_accept failed, 1:unexpected eof while reading
  2025-06-16 08:45:39 [178:root:430c2]Destroy sconn 0x7fd4c4d13800, connSize=10. (root)
  2025-06-16 08:45:40 [178:root:430c3]allocSSLConn:310 sconn 0x7fd4c4d13800 (0:root)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:before SSL initialization (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:before SSL initialization (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]got SNI server name: gateway.xxx.xxx realm (null)
  2025-06-16 08:45:40 [178:root:430c3]client cert requirement: no
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS read client hello (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS write server hello (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS write change cipher spec (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 early data (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 early data:(null)(103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 early data (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]got SNI server name: gateway.xxx.xxx realm (null)
  2025-06-16 08:45:40 [178:root:430c3]client cert requirement: no
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS read client hello (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS write server hello (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 write encrypted extensions (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS write certificate (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 write server certificate verify (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS write finished (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 early data (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 early data:(null)(103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:TLSv1.3 early data (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS read finished (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS write session ticket (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL state:SSLv3/TLS write session ticket (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384
  2025-06-16 08:45:40 [178:root:430c3]SSL state:fatal decode error (103.152.x.x)
  2025-06-16 08:45:40 [178:root:430c3]sslvpn_read_request_common,860, ret=-1 error=-1, sconn=0x7fd4c4d13800.
  2025-06-16 08:45:40 [178:root:430c3]Destroy sconn 0x7fd4c4d13800, connSize=10. (root)

  
  
  Regards,
  Azarudeen

[AEK]

Hi Azarudeen

The difference between FCT versions is that some have some issues that others don't, because they use sometimes different cypher algorithms that are older or newer, and they user different library versions, like for SSL/TLS and so.

In many cases, using different FCT version could fix the issue. I think it is worth testing.

[Azarudeen]

Let me try with the different versions.

[EasyDoesIT]

Hello, 
When you say they have another SSLVPN connection configured do you mean it's a different SSLVPN client or it's the same Forticlient with another connection? I have seen disconnects similar in 30 seconds if they have another SSLVPN client installed besides Forticlient. 

[Azarudeen]

Hi @EasyDoesIT,
Thanks for the response.
It mean the user have 2 different connection in the same FortiClient.
User don't the another SSL VPN client beside the FortiClient.

[Lourens82]

I don't have an answer, but I am experiencing exactly the same issue. And no one at our IT in my company are able to resolve it. 

I installed a later version 7.4.4.1887 and that helped for a few days but now it's doing it again. Connect for 30s and then disconnects.

Very frustrating to be stranded like this.

[Azarudeen]

Hi @Lourens82 ,

From our observation, the issue was caused by load balancing. In our case, users were trying to connect to the FortiClient VPN from a network with three ISP links configured for load balancing. As a result, whenever users attempted to connect to the VPN, the traffic often egressed through different WAN interfaces.

We opened a TAC case with Fortinet, and they suggested defining a policy route on the firewall by following these steps:

1. Navigate to Network > Policy Routes.

2. Set the Incoming Interface to LAN.

3. Leave the Source and Destination Address fields blank.

4. Select the Protocol as TCP.

5. Define the Destination Port as the FortiGate VPN listening port (e.g., 10443).

6. Set the Outgoing Interface to the specific WAN interface.

That’s it. You can try this configuration on your end and let us know how it goes.