forticlient Stuck at 80%

[ahmadhusain]

i facing the issue when i try to connect the ssl vpn form the forticilent it showing me this error

"unable to logon to the server. your username or password may not be configured (-12)"

i have checked the username and password its correct 

Please help me regarding this issue

Thanks 

[Toshi_Esumi]

Generally the user authentication is completed when it passed 48% mark. Something else must be causing to stop there. To figure it out, you need to run "diag debug app sslvpn -1" and try connecting it. If it always stops at the same point, it would tell you a hint what failed.

[ahmadhusain]

i'm still getting same error after run the "diag debug app sslvpn -1" command on the fortigate 

[Toshi_Esumi]

That's the command to trigger ssl vpn application logging. If you're not connected at console, you have to type "diag debug ena" as well to get the output into your SSH session. Then you'll get a lot of log to analyze what's going on when it fails. It's not a command to "fix" the problem.

[ahmadhusain]

[6155:root:0]cleanup policy id cache for vfid 0

[6155:root:0]process policy (v6:0) id cache for root (0)

[6155:root:0]insert policy id 18 for vfid (0)

[6155:root:0]total sslvpn policy count: 1

[6151:root:0]total sslvpn policy count: 1

[6154:root:0]cleanup policy id cache for vfid 0

[6154:root:0]process policy (v6:0) id cache for root (0)

[6154:root:0]insert policy id 18 for vfid (0)

[6154:root:0]total sslvpn policy count: 1

i got this log when i ran 

"diag debug ena" command

but didn't understand what is the exact issue

can you please see the log and assist me

thanks 

[Toshi_Esumi]

You should get much more when you try to connect. You're looking for logs including something like "error" or "fail", or something like that. When you do it again and again while watching at both the percentage progress on the client and logging output on your ssh session, you'll come to understand what part of the log is doing what inside of the FGT. If you have any successful users, you want to compare the logging between a good one and an failed one. 

You can reset debugging by "diag debug reset".

[ahmadhusain]

thanks for you help

but the issue didn't resolve yet

i need to ask one more thing 

my firewall is configured behind of the Cisco router so no direct public IP configured to FG

can you please tell what should i configured on the cisco router 

i have performed the NAT to private ip to public Ip to access the VPN and used port for the ipsec (8900, 1723)

and for the SSLVPN (10443)

locally i can access and connect ipsec and sslvpn and web 

but from outer i can't access 

showing the above error 

Please reply 

Thanks once again 

[Toshi_Esumi]

SSL VPN is whatever you configured for the TCP port (default 443), looks like you configured 10443. But IPSec always use UDP 500 and 4500.