invalid auth params for user

[noamg]

Hi All,

The subject line (invalid auth params for user) represents the error output of debug SSL VPN auth issue I've encountered. I have tried everything I know to troubleshoot this issue but without any luck. users are unable to login to the SSL-VPN. It's a new 40F appliance version 7.0.4.

I was trying local user and LDAP user

I've changed the listening port to something else

made sure to assign the user to the SSL portal, try to change to other portal

Used forticliet to make the connection. 

made sure the policy configured properly.

any ideas?

[mturic]

Hi, 

checking the debug messages should be a good start, you can run the following debugs over CLI and try to authenticate again:

diag debug reset

diag debug console timestamp enable

diag debug app fnbamd -1

diag debug app sslvpn -1

diag debug enable

To authenticate over SSL you would need:
1) a valid firewall policy with the user/group with source interface ssl.root 

2) that same user/group added to the SSLVPN portal mapping, so that after authentication sslvpnd can map the user to the correct SSLVPN portal

You can also check also the following articles for further info:
https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/478309/ssl-vpn-using-web-and-tunnel-mode

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-Troubleshooting/ta-p/189542?...