VPN stops working - need reboot of entire system

[dasilva13]

Has anyone else had issues with SSLVPN service just stop working? And the only way to have it work again is to reboot entire FortiGate? My users would complain about VPN not working, and then I would try to get to port :10443 and it would not go through. After reboot it would come back up and work normally for some time. does not mention conserve mode, and I have had it happen on all versions from 60c to 100d.

[Carl_Wallmark]

Hi Chris, This was good info, but I dont get the numbers. This is from a FG100D Gen3. I have 1 user connected, and the " Maximum Users" says 7 ? and " Tunnels" 4 ? It must be calculating it wrong ? SSLVPN statistics: ------------------ Memory unit: 1 System total memory: 4148420608 System free memory: 3388563456 SSLVPN memory margin: 314572800 SSLVPN state: normal Max number of users: 7 Max number of tunnels: 4 Max number of connections: 10 Current number of users: 1 Current number of tunnels: 1 Current number of connections: 1

[Christopher_McMullan]

Maximum users includes both tunnel- and web-mode users, so a smaller number of tunnels is possible before the available memory is exhausted. The daemon is currently in a normal state. If the problem happens again, run the command while it' s still going on, and see how the numbers compare to this baseline.

[Carl_Wallmark]

So you mean that 7 concurrent users is the maximun number of users before it is going into conserve mode?

[Christopher_McMullan]

Based on current available memory, yes. If more memory is freed up, you should see this number increase.

[neonbit]

Hi Chris, Surely a 100D should be able to support more than 7 concurrent SSLVPN users? The datasheets say that the recommended ssl vpn users for the 100D is 300. Even if only 10% of these users are connecting at the same time that would be 30; more than 4 times the maximum concurrent users the memory says it can handle. I just ran this on our FG110C and can see the maximum users is 3. I hope this isn' t correct...

[Carl_Wallmark]

Yes, there must be something wrong with those numbers. Perhaps it is allocating more memory when it reaches the maximum users, but then the word " maximum" is wrong.

[netmin]

I think ' max concurrent ... (seen)' would better fit these numbers.

[Christopher_McMullan]

Could be. There' s a large ' AFAIK' around this command.