i facing the issue when i try to connect the ssl vpn form the forticilent it showing me this error
"unable to logon to the server. your username or password may not be configured (-12)"
i have checked the username and password its correct
Please help me regarding this issue
Thanks
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Generally the user authentication is completed when it passed 48% mark. Something else must be causing to stop there. To figure it out, you need to run "diag debug app sslvpn -1" and try connecting it. If it always stops at the same point, it would tell you a hint what failed.
i'm still getting same error after run the "diag debug app sslvpn -1" command on the fortigate
That's the command to trigger ssl vpn application logging. If you're not connected at console, you have to type "diag debug ena" as well to get the output into your SSH session. Then you'll get a lot of log to analyze what's going on when it fails. It's not a command to "fix" the problem.
[6155:root:0]cleanup policy id cache for vfid 0
[6155:root:0]process policy (v6:0) id cache for root (0)
[6155:root:0]insert policy id 18 for vfid (0)
[6155:root:0]total sslvpn policy count: 1
[6151:root:0]total sslvpn policy count: 1
[6154:root:0]cleanup policy id cache for vfid 0
[6154:root:0]process policy (v6:0) id cache for root (0)
[6154:root:0]insert policy id 18 for vfid (0)
[6154:root:0]total sslvpn policy count: 1
i got this log when i ran
"diag debug ena" command
but didn't understand what is the exact issue
can you please see the log and assist me
thanks
You should get much more when you try to connect. You're looking for logs including something like "error" or "fail", or something like that. When you do it again and again while watching at both the percentage progress on the client and logging output on your ssh session, you'll come to understand what part of the log is doing what inside of the FGT. If you have any successful users, you want to compare the logging between a good one and an failed one.
You can reset debugging by "diag debug reset".
thanks for you help
but the issue didn't resolve yet
i need to ask one more thing
my firewall is configured behind of the Cisco router so no direct public IP configured to FG
can you please tell what should i configured on the cisco router
i have performed the NAT to private ip to public Ip to access the VPN and used port for the ipsec (8900, 1723)
and for the SSLVPN (10443)
locally i can access and connect ipsec and sslvpn and web
but from outer i can't access
showing the above error
Please reply
Thanks once again
SSL VPN is whatever you configured for the TCP port (default 443), looks like you configured 10443. But IPSec always use UDP 500 and 4500.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1643 | |
1069 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.