VPN Server may be unreachable (-14) (Forticlient SSL VPN)

[MCs101]

I have this error only for one user. VPN stops at 80% with the error. 

Tried another user and it works. 

On the same computer tried on Windows10 and 11:  KO

User "A" : KO

User "B" : OK, works fine.

User "A" password is not expired, account is working everywhere. Even tried to change password several times...

Tried user "A" with both ForticlientEMS 7.0.7  and Free ForticlientVPN 7.0.7 : KO

Tried user "A" on another computer, still getting the same error. On the other hand user "B" can login everytime. 

Hostcheck is not enabled on the vpn portals. 

Thank you for the help

[abarushka]

Hello,

You may consider to collect debug traces below (FortiGate) once the issue is triggered:

diagnose debug application fnbamd -1
diagnose debug application sslvpn -1
diagnose debug enable

[haahaahaa]

Hi!
I have exactly the same problem since Feb 12. I cannot use SSLVPN with local user suddenly. Fortunately I can use VPN with AD domain users and with new local user.
Fortigate is 80F, 7.0.9. Clients are different: Win 10 and FortiClient 7.0.7; Win 10 and FortiClient 7.0.5; Android.
Diagnostic data from Fortigate:

[260:root:4]sslvpn_validate_user_group_list:1979 checking rule 2 realm.
[260:root:4]sslvpn_validate_user_group_list:1990 checking rule 2 source intf.
[260:root:4]sslvpn_validate_user_group_list:2571 rule 2 done, got user (0:0) group (2:0) peer group (0).
[260:root:4]sslvpn_validate_user_group_list:1971 checking rule 3 cipher.
[260:root:4]sslvpn_validate_user_group_list:1979 checking rule 3 realm.
[260:root:4]sslvpn_validate_user_group_list:1990 checking rule 3 source intf.
[260:root:4]sslvpn_validate_user_group_list:2571 rule 3 done, got user (0:0) group (3:0) peer group (0).
[260:root:4]sslvpn_validate_user_group_list:2865 got user (1:0), group (3:0) peer group (0).
[260:root:4]sslvpn_update_user_group_list:1793 got user (1:0), group (3:0), peer group (0) after update.
[260:root:4]two factor check for MyUsername: off
[260:root:4]sslvpn_authenticate_user:183 authenticate user: [MyUsername]
[260:root:4]sslvpn_authenticate_user:197 create fam state
[260:root:4]fam_auth_send_req:882 found node MyUsername:0:, valid:1
[260:root:4][fam_auth_send_req_internal:426] Groups sent to FNBAM:
[260:root:4]group_desc[0].grpname = MyUsername
[260:root:4]group_desc[1].grpname = VPNgruppMonitor
[260:root:4][fam_auth_send_req_internal:438] FNBAM opt = 0X201420
local auth is done with user 'MyUsername', ret=0
[260:root:4]fam_auth_send_req_internal:514 fnbam_auth return: 0
[260:root:4][fam_auth_send_req_internal:539] Authenticated groups (2) by FNBAM with auth_type (1):
[260:root:4]Received: auth_rsp_data.grp_list[0] = 16777219
[260:root:4]Received: auth_rsp_data.grp_list[1] = 2
[260:root:4]fam_auth_send_req_internal:563 found node VPNgruppMonitor:0:, valid:1, auth:0
[260:root:4]Validated: auth_rsp_data.grp_list[1] = VPNgruppMonitor
[260:root:4][fam_auth_send_req_internal:652] The user MyUsername is authenticated.
[260:root:4]fam_do_cb:665 fnbamd return auth success.
[260:root:4]SSL VPN login matched rule (0).
[260:root:4]got public IP address: 46.131.43.197
[260:root:4]User Agent: FortiSSLVPN (Windows NT; SV1 [SV{v=02.01; f=07;}])
[260:root:4]rmt_web_session_create:1209 create web session, idx[1]
[260:root:4]login_succeeded:536 redirect to hostcheck
[260:root:4]User Agent: FortiSSLVPN (Windows NT; SV1 [SV{v=02.01; f=07;}])
[260:root:4]deconstruct_session_id:709 decode session id ok, user=[MyUsername], group=[],authserver=[],portal=[web-access],host[46.13                                                            1.43.197],realm=[],csrf_token=[6F93DBB6ACE5FFCC336673B8F7D21F16],idx=1,auth=1,sid=30012949,login=1676273525,access=1676273525,sam                                                            l_logout_url=no,pip=46.131.43.197,grp_info=[mDtuvR],rmt_grp_info=[]
[260:root:4]deconstruct_session_id:709 decode session id ok, user=[MyUsername], group=[],authserver=[],portal=[web-access],host[46.13                                                            1.43.197],realm=[],csrf_token=[6F93DBB6ACE5FFCC336673B8F7D21F16],idx=1,auth=1,sid=30012949,login=1676273525,access=1676273525,sam                                                            l_logout_url=no,pip=46.131.43.197,grp_info=[mDtuvR],rmt_grp_info=[]
[260:root:4]deconstruct_session_id:709 decode session id ok, user=[MyUsername], group=[],authserver=[],portal=[web-access],host[46.13                                                            1.43.197],realm=[],csrf_token=[6F93DBB6ACE5FFCC336673B8F7D21F16],idx=1,auth=1,sid=30012949,login=1676273525,access=1676273525,sam                                                            l_logout_url=no,pip=46.131.43.197,grp_info=[mDtuvR],rmt_grp_info=[]
[260:root:4]req: /remote/fortisslvpn
[260:root:4]deconstruct_session_id:709 decode session id ok, user=[MyUsername], group=[],authserver=[],portal=[web-access],host[46.13                                                            1.43.197],realm=[],csrf_token=[6F93DBB6ACE5FFCC336673B8F7D21F16],idx=1,auth=1,sid=30012949,login=1676273525,access=1676273525,sam                                                            l_logout_url=no,pip=46.131.43.197,grp_info=[mDtuvR],rmt_grp_info=[]
[260:root:4]deconstruct_session_id:709 decode session id ok, user=[MyUsername], group=[],authserver=[],portal=[web-access],host[46.13                                                            1.43.197],realm=[],csrf_token=[6F93DBB6ACE5FFCC336673B8F7D21F16],idx=1,auth=1,sid=30012949,login=1676273525,access=1676273525,sam                                                            l_logout_url=no,pip=46.131.43.197,grp_info=[mDtuvR],rmt_grp_info=[]
[260:root:4]Timeout for connection 0x7fb2d56500.

[260:root:4]Destroy sconn 0x7fb2d56500, connSize=0. (root)
[260:root:4]SSL state:warning close notify (aaa.bbb.ccc.ddd)
[260:root:0]sslvpn_internal_remove_one_web_session:3510 web session (root:MyUsername::aaa.bbb.ccc.ddd:1 1) removed for tunnel connection setup timeout

and data from "C:\Program Files\Fortinet\FortiClient\logs\trace\sslvpndaemon_1.log"

[2023-02-13 10:04:56.6336487] [9732:9880] [sslvpndaemon 517 debug] FortiSslvpn: Init:ConnectNamedPipe(): Wait(hEventOverLapped) OK.

[2023-02-13 10:04:56.6488584] [9732:9880] [sslvpndaemon 517 debug] FortiSslvpn: before ConnectNamedPipe

[2023-02-13 10:04:56.6488975] [9732:9880] [sslvpndaemon 517 debug] FortiSslvpn: Init:ConnectNamedPipe(): rc=0, err=997

[2023-02-13 10:04:56.6489787] [9732:13704] [sslvpndaemon 517 debug] FortiSslvpn: _ReceiveMessage: (000005AC)
[2023-02-13 10:05:03.1590693] [9732:21028] [sslvpndaemon 517 debug] FortiSslvpn: SSL VPN Tunnel is Disconnected *********

[2023-02-13 10:05:03.1592588] [9732:21028] [sslvpndaemon 517 debug] FortiSslvpn: Broken pipe! Client is exited (3).

[2023-02-13 10:05:03.3034939] [9732:9880] [sslvpndaemon 517 debug] FortiSslvpn: Init:ConnectNamedPipe(): Wait(hEventOverLapped) OK.

[2023-02-13 10:05:03.3178161] [9732:9880] [sslvpndaemon 517 debug] FortiSslvpn: before ConnectNamedPipe

[2023-02-13 10:05:03.3178255] [9732:9880] [sslvpndaemon 517 debug] FortiSslvpn: Init:ConnectNamedPipe(): rc=0, err=997

[2023-02-13 10:05:03.3179321] [9732:10752] [sslvpndaemon 517 debug] FortiSslvpn: _ReceiveMessage: (0000048C)
[2023-02-13 10:05:05.4372440] [9732:9880] [sslvpndaemon 517 debug] FortiSslvpn: Init:ConnectNamedPipe(): Wait(hEventOverLapped) OK.

[2023-02-13 10:05:05.4530352] [9732:9880] [sslvpndaemon 517 debug] FortiSslvpn: before ConnectNamedPipe

[2023-02-13 10:05:05.4530451] [9732:9880] [sslvpndaemon 517 debug] FortiSslvpn: Init:ConnectNamedPipe(): rc=0, err=997

[2023-02-13 10:05:05.4531419] [9732:22544] [sslvpndaemon 517 debug] FortiSslvpn: _ReceiveMessage: (00000498)
[2023-02-13 10:05:08.3360704] [9732:10752] [sslvpndaemon 788] RunUpdateToGetPublicIP ret = 0
[2023-02-13 10:05:11.8757101] [9732:13704] [sslvpndaemon 517 debug] FortiSslvpn: Broken pipe! Client is exited (3).

[abarushka · Accepted solution]

Hello,

Authentication looks good.

[260:root:4][fam_auth_send_req_internal:652] The user MyUsername is authenticated.
[260:root:4]fam_do_cb:665 fnbamd return auth success.

I would recommend to double check whether firewall policy exists:

[260:root:4]SSL VPN login matched rule (0).