"Fortinet SSL VPN Virtual Ethernet Adapter" eneabled but Disconnected

matteo_devilli · ‎04-22-2020

in attach the Forticlient log and Windows IP configuration after connection.

Windows IP Configuration Host Name . . . . . . . . . . . . : ************-DSK Primary Dns Suffix . . . . . . . : *******domain.local Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : *******domain.local Ethernet adapter Ethernet: Connection-specific DNS Suffix . : homenet.telecomitalia.it Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller Physical Address. . . . . . . . . : 0C-9D-92-C1-8E-81 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::9c23:60a7:c421:b4b5%2(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.1.126(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Wednesday, April 22, 2020 12:16:54 Lease Expires . . . . . . . . . . : Thursday, April 22, 2021 12:16:54 Default Gateway . . . . . . . . . : 192.168.1.1 DHCP Server . . . . . . . . . . . : 192.168.1.1 DHCPv6 IAID . . . . . . . . . . . : 336371090 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-23-4D-07-7B-0C-9D-92-C1-8E-81 DNS Servers . . . . . . . . . . . : fe80::22b0:1ff:fe22:deea%2 192.168.1.1 NetBIOS over Tcpip. . . . . . . . : Enabled Connection-specific DNS Suffix Search List : homenet.telecomitalia.it

22/04/2020 12:18:37 Information VPN id=96602 msg="SSLVPN service started successfully" vpnstate= 22/04/2020 12:19:58 Information Other id=96900 msg="This log is sent to FortiAnalyzer for analysis" sessionid=2318117777 srcname=sslvpn srcport=0 direction=outbound dstip=***.***.***.*** dstport=14430 proto=6 rcvdbyte=2769278032 sentbyte=508 utmaction=passthrough utmevent=vpn threat=connect userinitiated=0 browsetime=0 22/04/2020 12:19:58 Information VPN FortiSslvpn: 12100: fortissl_connect: device=ftvnic 22/04/2020 12:19:58 Information VPN FortiSslvpn: 12316: PreferDtlsTunnel=0 22/04/2020 12:19:59 Information Other id=96900 msg="This log is sent to FortiAnalyzer for analysis" sessionid=2318117777 srcname=sslvpn srcport=0 direction=outbound dstip=***.***.***.*** dstport=14430 proto=6 rcvdbyte=4294967296 sentbyte=4294967296 utmaction=passthrough utmevent=vpn threat=disconnect userinitiated=0 browsetime=0 22/04/2020 12:20:13 Information Other id=96900 msg="This log is sent to FortiAnalyzer for analysis" sessionid=2663513638 srcname=sslvpn srcip=***.***.***.*** srcport=0 direction=outbound dstip=***.***.***.*** dstport=14430 proto=6 rcvdbyte=4294967296 sentbyte=4294967296 utmaction=passthrough utmevent=vpn threat=connect userinitiated=0 browsetime=0 22/04/2020 12:20:13 Information VPN id=96600 user=********@********DOMAIN.LOCAL msg="SSLVPN tunnel status" vpnstate=connected vpntunnel=vpn_dmx 22/04/2020 12:24:33 Information VPN FortiSslvpn: 12312: Ras: connection to fortissl terminated 22/04/2020 12:24:36 Information Other id=96900 msg="This log is sent to FortiAnalyzer for analysis" sessionid=2663513638 srcname=sslvpn srcip=***.***.***.*** srcport=0 direction=outbound dstip=***.***.***.*** dstport=14430 proto=6 rcvdbyte=4294967296 sentbyte=4294967296 utmaction=passthrough utmevent=vpn threat=disconnect userinitiated=0 browsetime=0 22/04/2020 12:27:19 Information VPN FortiSslvpn: 11148: fortissl_connect: device=ftvnic 22/04/2020 12:27:19 Information VPN FortiSslvpn: 12108: PreferDtlsTunnel=0 22/04/2020 12:27:34 Information Other id=96900 msg="This log is sent to FortiAnalyzer for analysis" sessionid=3666532738 srcname=sslvpn srcip=***.***.***.*** srcport=0 direction=outbound dstip=***.***.***.*** dstport=14430 proto=6 rcvdbyte=8589934592 sentbyte=8589934592 utmaction=passthrough utmevent=vpn threat=connect userinitiated=0 browsetime=0 22/04/2020 12:27:34 Information VPN id=96600 user=********@********DOMAIN.LOCAL msg="SSLVPN tunnel status" vpnstate=connected vpntunnel=vpn_dmx 22/04/2020 12:34:37 Information VPN FortiSslvpn: 3460: Ras: connection to fortissl terminated 22/04/2020 12:34:39 Information Other id=96900 msg="This log is sent to FortiAnalyzer for analysis" sessionid=3666532738 srcname=sslvpn srcip=***.***.***.*** srcport=0 direction=outbound dstip=***.***.***.*** dstport=14430 proto=6 rcvdbyte=8589934592 sentbyte=8589934592 utmaction=passthrough utmevent=vpn threat=disconnect userinitiated=0 browsetime=0 22/04/2020 12:35:10 Debug VPN FortiSslvpn: Init:ConnectNamedPipe(): Wait(hEventOverLapped) OK. 22/04/2020 12:35:10 Debug VPN FortiSslvpn: before ConnectNamedPipe 22/04/2020 12:35:10 Debug VPN FortiSslvpn: Init:ConnectNamedPipe(): rc=0, err=997 22/04/2020 12:35:10 Debug VPN FortiSslvpn: _ReceiveMessage: (00000408) 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 12580: fortissl_connect() called. (ipv6=0, fct=1) 22/04/2020 12:35:10 Information VPN FortiSslvpn: 12580: fortissl_connect: device=ftvnic 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 12580: IpAddrInfo->hostName='***.***.***.***'. 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 12580: Resolve server '***.***.***.***(14430)' = ***.***.***.***:14430/[0000:0000:0000:0000:0000:0000:0000:0000]:0. 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 12580: Setting route to ***.***.***.*** 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 12580: on 192.168.1.1 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 12580: get_interface_metric() called, local index:2 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 12580: metric: 25 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 12580: CreateIpForwardEntry(dest=f29a15d5 mask=ffffffff next=0101a8c0) 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 12580: IPv4SetRouteToFgt(000001FC7EA9DA6C, 000001FC7EA9DAB8)=0 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 12580: get_interface_metric() called, local index:2 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 12580: metric: 25 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 12580: SetIPv4RouteSRV: CreateIpForwardEntry(dest=0101a8c0 mask=ffffffff next=7e01a8c0) 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: tunnel_thread() called 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 5684: ras_thread() called 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: * tunnel opened 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: * SSL OK 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: * tunnel pending ... 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: info: tunnel_start_to_fgt(000001FC7EA8DB70) called. 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: connecting tunnel (0) ... 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: connecting TCP ... 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: TCP_NODELAY value:1 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: WSAConnect(1,0), r=-1, e=10035. 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: Socket event signaled! 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: connecting SSL ... 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: call back called! 22/04/2020 12:35:10 Debug VPN (repeated 2 times in last 0 sec) FortiSslvpn: 8708: call back called! 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: SSL connected 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: [DoXmlConfig]... 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: info: SslBlockingWrite(000001FC7EB17C40, 000001FC7F957040, 331, 10000) called. 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: [DoXmlConfig]: GET remote/fortisslvpn_xml ... (send 331 of 331 bytes): 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFCD80, 8191, 10000) called. 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFCD80, 8191, 10000) done. (n=1169) 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: [DoXmlConfig]: GET remote/fortisslvpn_xml ... (received 1154 bytes): HTTP/1.1 200 OK Date: Wed, 22 Apr 2020 10:35:56 GMT Server: xxxxxxxx-xxxxx Transfer-Encoding: chunked Content-Type: text/xml X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 <?xml version='1.0' encoding='utf-8'?><sslvpn-tunnel ver='2' dtls='1' patch='1'><dtls-config heartbea 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: [DoXmlConfigEx]: Xml= <?xml version='1.0' encoding='utf-8'?><sslvpn-tunnel ver='2' dtls='1' patch='1'><dtls-config heartbeat-interval='10' heartbeat-fail-count='10' heartbeat-idle-timeout='10' client-hello-timeout='10' /><tunnel-method value='ppp' /><tunnel-method value='tun' /><fos platform='FG100D' major='6' minor='02' patch='0' build='0866' branch='0866' /><auth-ses check-src-ip='1' tun-connect-without-reauth='0' tun-user-ses-timeout='30' /><client-config save-password='on' keep-alive 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: [DoXmlConfig]: dnsSuffixes = 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: [DoXmlConfig]: DTLS=1, DHI=10, DHFC=10, DHIT=10, DCHT=10 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: [DoLicCheck]... 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: info: SslBlockingWrite(000001FC7EB17C40, 00000025A5AF6DE0, 779, 10000) called. 22/04/2020 12:35:10 Debug VPN FortiSslvpn: 8708: [DoLicCheck]: GET /remote/licensecheck ... (usr=********, send 779 of 779 bytes): 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AF3D30, 8191, 10000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AF3D30, 8191, 10000) done. (n=886) 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: [DoLicCheck]: GET /remote/licensecheck ... (received 871 bytes): HTTP/1.1 200 OK Date: Wed, 22 Apr 2020 10:35:56 GMT Server: xxxxxxxx-xxxxx FCC_Status: 20 FCC_Message: 5645523d310a434f44453d300a Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 <html> <head> <meta http-equiv=" 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: [DoLicCheck]: After DecodeLicenseResult(): s=20, r=0, message= 5645523d310a434f44453d300a VER=1 CODE=0 ---- 22/04/2020 12:35:11 Information VPN FortiSslvpn: 8708: PreferDtlsTunnel=0 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: ===>send to login, ret=346 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingWrite(000001FC7EB17C40, 000001FC7EB413C0, 22, 5000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D0, 6, 5000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D0, 6, 5000) done. (n=6) 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D6, 12, 5000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D6, 12, 5000) done. (n=12) 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingWrite(000001FC7EB17C40, 000001FC7EB41180, 18, 5000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D0, 6, 5000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D0, 6, 5000) done. (n=6) 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D6, 16, 5000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D6, 16, 5000) done. (n=16) 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingWrite(000001FC7EB17C40, 000001FC7EB41270, 30, 5000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D0, 6, 5000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D0, 6, 5000) done. (n=6) 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D6, 12, 5000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D6, 12, 5000) done. (n=12) 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingWrite(000001FC7EB17C40, 000001FC7EB41600, 18, 5000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D0, 6, 5000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D0, 6, 5000) done. (n=6) 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D6, 24, 5000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D6, 24, 5000) done. (n=24) 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingWrite(000001FC7EB17C40, 000001FC7EB41480, 30, 5000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D0, 6, 5000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D0, 6, 5000) done. (n=6) 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D6, 24, 5000) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: SslBlockingRead(000001FC7EB17C40, 00000025A5AFE5D6, 24, 5000) done. (n=24) 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: SslvpnVnicPppConnect: 0 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: ssl_connect -> Set XmlConfig OK. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8708: info: tunnel_up(000001FC7EA8DB70, 1) called. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 5684: info: ras_loop(), XmlConfig OK. 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8512: monitor_thread() called 22/04/2020 12:35:11 Debug VPN FortiSslvpn: 8512: register_route_change_event_ipv4() called 22/04/2020 12:35:11 Debug VPN FortiSslvpn: g_dwKeepRunningFlag = 0. 22/04/2020 12:35:12 Debug VPN FortiSslvpn: 8708: tunnel_up() sleep(1000) 22/04/2020 12:35:12 Debug VPN FortiSslvpn: 8708: info: tunnel_start(000001FC7EA8DB70) called. 22/04/2020 12:35:12 Debug VPN FortiSslvpn: 8708: connecting tunnel (1) ... 22/04/2020 12:35:12 Debug VPN FortiSslvpn: 8708: opening tunnel handle ... 22/04/2020 12:35:13 Debug VPN FortiSslvpn: 8708: tunnel_loop(000001FC7EA8DB70) called. 22/04/2020 12:35:13 Debug VPN FortiSslvpn: 2900: [poll_read] pending 22/04/2020 12:35:13 Debug VPN FortiSslvpn: 2900: isDtlsTunnel=0, 10 22/04/2020 12:35:13 Debug VPN FortiSslvpn: 2900: [tunnel_loop_read_driver] wait for adapter 22/04/2020 12:35:13 Debug VPN FortiSslvpn: 9720: [tunnel_loop_read_socket] tun->sock: 0000000000000414 22/04/2020 12:35:13 Debug VPN FortiSslvpn: 9720: [tunnel_loop_read_socket] set event mode: 33 22/04/2020 12:35:25 Debug VPN FortiSslvpn: 5684: Ras : dialing fortissl 22/04/2020 12:35:25 Debug VPN FortiSslvpn: 5684: RasStatus : connected to fortissl 22/04/2020 12:35:26 Information Other id=96900 msg="This log is sent to FortiAnalyzer for analysis" sessionid=3235372644 srcname=sslvpn srcip=***.***.***.*** srcport=0 direction=outbound dstip=***.***.***.*** dstport=14430 proto=6 rcvdbyte=12884901888 sentbyte=12884901888 utmaction=passthrough utmevent=vpn threat=connect userinitiated=0 browsetime=0 22/04/2020 12:35:26 Information VPN id=96600 user=********@********DOMAIN.LOCAL msg="SSLVPN tunnel status" vpnstate=connected vpntunnel=vpn_dmx 22/04/2020 12:35:26 Debug VPN FortiSslvpn: Init:ConnectNamedPipe(): Wait(hEventOverLapped) OK. 22/04/2020 12:35:26 Debug VPN FortiSslvpn: before ConnectNamedPipe 22/04/2020 12:35:26 Debug VPN FortiSslvpn: Init:ConnectNamedPipe(): rc=0, err=997 22/04/2020 12:35:26 Debug VPN FortiSslvpn: _ReceiveMessage: (000003B8) 22/04/2020 12:35:26 Debug VPN FortiSslvpn: Broken pipe! Client is exited (3). 22/04/2020 12:35:33 Debug VPN FortiSslvpn: 10892: fortissl_getstatus(2426) called