ssl-vpn on FG200D

[cparfon]

Hello,

I have a issue with one of our companies people, which has to work from China. We have a FG200D and it's running a ssl-vpn. All our employees are able to connect to the office network through the SSL-VPN but this one fella which works from China isn't able to connect. I'm very much aware that in China they have lots of restrictions but I was just looking for a way to work this out somehow. Any ideas?

Thanks.

[Christopher_McMullan]

What port do users target to connect to the SSLVPN? If 10443 is the default, I would consider changing it to 443, and move the HTTPS GUI management port to 444, or 10443.

I used the SSLVPN web portal on my home firewall to do some proxy browsing from Cuba while on vacation a couple years back, and I made sure to set the port to 443 in case other ports were blocked.

Otherwise, try a sniff, flow trace, and debug of the sslvpn daemon sequentially to see what's happening:

di sniff pack any "host w.x.y.z and port 443" 4 //--replace w.x.y.z with the public IP of the FortiGate people target for their SSLVPN connections

<attempt a connection, then press Ctl+C to stop the capture>

di de reset

di de en

di de fl s c en

di de fl s f en

di de fl filter addr w.x.y.z //--same as above

di de fl filter port 443 //--same as above

di de fl tr start 5000

di de fl tr stop //--type this without pressing Enter, so you can easily stop the flow trace later regardless of how much output is flying by

<attempt a connection, then...>

di de fl filter clear

di de reset

di de app sslvpn -1

<attempt a connection, then...>

di de reset

di de di

[cparfon]

Hi Christopher,

First, thank you for taking the time to answer my question.

Second, to answer your question, we DO USE port 443 for the users to connect to the SSLVPN, and it works flawlessly for all of them, except for this one person which is located in China (Beijing).

I did as you suggested and here's the traffic capture done during the connection attempt of that person from China (atached to this post).

Btw, the public IP address in that capture belongs to our employee in China.

Also, here's  `FortiClient` client log:

1/7/2015 6:24:42 PM Notice FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 1/7/2015 6:24:42 PM Notice VPN id=96602 msg="SSLVPN service started successfully." vpntype=ssl 1/7/2015 6:24:57 PM Warning FortiShield id=96855 msg="FortiShield blocked application: FortiClientOnl from modifying: \\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Fortinet\\FortiClient\\FA_UPDATE\\SoftwareUpdate\\IgnoreVersion" 1/7/2015 7:26:50 PM Notice VPN date=2015-01-07 time=19:26:49 logver=1 type=traffic level=notice sessionid=25224176 hostname=P15P2GL-01 uid=E2BFA8B9FF2B4936924567E70ABDCDA5 devid=FCT8002984563811 fgtserial=N/A regip=N/A srcname=sslvpn srcip=N/A srcport=N/A direction=outbound remoteip=XX.XX.XX.XX remotename=N/A remoteport=443 url=N/A user=N/A proto=ssl rcvdbyte=1982452785 sentbyte=0 utmaction=passthrough utmevent=vpn threat=connect vd=N/A 1/7/2015 7:26:51 PM Notice VPN date=2015-01-07 time=19:26:50 logver=1 type=traffic level=notice sessionid=25224176 hostname=P15P2GL-01 uid=E2BFA8B9FF2B4936924567E70ABDCDA5 devid=FCT8002984563811 fgtserial=N/A regip=N/A srcname=sslvpn srcip=N/A srcport=N/A direction=outbound remoteip=XX.XX.XX.XX remotename=N/A remoteport=443 url=N/A user=lan.liu proto=ssl rcvdbyte=4294967296 sentbyte=0 utmaction=passthrough utmevent=vpn threat=disconnect vd=N/A 1/7/2015 7:27:05 PM Error VPN FortiSslvpn: 50416: Ras : connection to fortissl failed : 680:2:There was no dial tone. 1/7/2015 7:39:53 PM Error VPN FortiSslvpn: 45460: Ras : connection to fortissl failed : 0:0: 1/7/2015 7:44:01 PM Error VPN FortiSslvpn: 44504: Ras : connection to fortissl failed : 0:0: 1/7/2015 9:30:18 PM Error VPN FortiSslvpn: 25580: Ras : connection to fortissl failed : 0:8193: 1/7/2015 9:42:47 PM Error VPN FortiSslvpn: 34500: Ras : connection to fortissl failed : 0:0: 1/16/2015 4:06:42 AM Notice FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 1/16/2015 4:06:45 AM Notice VPN id=96602 msg="SSLVPN service started successfully." vpntype=ssl 1/19/2015 8:20:35 AM Notice FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 1/19/2015 8:20:38 AM Notice VPN id=96602 msg="SSLVPN service started successfully." vpntype=ssl 1/20/2015 8:43:39 AM Notice FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 1/20/2015 8:43:43 AM Notice VPN id=96602 msg="SSLVPN service started successfully." vpntype=ssl 1/22/2015 7:24:52 PM Notice VPN date=2015-01-22 time=19:24:51 logver=1 type=traffic level=notice sessionid=30401100 hostname=P15P2GL-01 uid=E2BFA8B9FF2B4936924567E70ABDCDA5 devid=FCT8002984563811 fgtserial=N/A regip=N/A srcname=sslvpn srcip=N/A srcport=N/A direction=outbound remoteip=XX.XX.XX.XX remotename=N/A remoteport=443 url=N/A user=N/A proto=ssl rcvdbyte=2000081969 sentbyte=0 utmaction=passthrough utmevent=vpn threat=connect vd=N/A 1/22/2015 7:24:52 PM Notice VPN date=2015-01-22 time=19:24:52 logver=1 type=traffic level=notice sessionid=30401100 hostname=P15P2GL-01 uid=E2BFA8B9FF2B4936924567E70ABDCDA5 devid=FCT8002984563811 fgtserial=N/A regip=N/A srcname=sslvpn srcip=N/A srcport=N/A direction=outbound remoteip=XX.XX.XX.XX remotename=N/A remoteport=443 url=N/A user=lan.liu proto=ssl rcvdbyte=4294967296 sentbyte=0 utmaction=passthrough utmevent=vpn threat=disconnect vd=N/A 1/22/2015 7:25:05 PM Error VPN FortiSslvpn: 17668: Ras : connection to fortissl failed : 0:8193: 1/22/2015 7:28:34 PM Error VPN FortiSslvpn: 16548: Ras : connection to fortissl failed : 0:0: 1/22/2015 7:32:48 PM Error VPN FortiSslvpn: 13132: Ras : connection to fortissl failed : 0:0:

[cparfon]

We have also tried SSLVPN web portal. Unfortunately no luck with it also. :(

[Christopher_McMullan]

Does it make any difference if they try connecting via a web browser to the SSLVPN web portal instead of using FortiClient?

That'll help narrow the issue down, to see if a connection is possible at all, and then if so, why not with FortiClient?

[Christopher_McMullan]

Has the client ever been able to successfully connect to the SSLVPN using FortiClient in the past, and/or from some other location?

[cparfon]

Yes. Everywhere outside China. :|

[Christopher_McMullan]

Just that the FortiClient output for the fortissl adapter stands out as odd to me: no dialtone?

Thinking outside the box, I'm wondering if IPsec could get through, or else just using the web portal with a connection tool or bookmarks to access internal resources as one workaround.

Can they get to the web portal at least, or nothing at all through the browser?

[cparfon]

Yeah. They are able to access the FG VPN web portal and connect. But nothing apparently works. 

Looking at logs when they connect to the portal I can see this:

date=2015-01-22 time=13:47:46 logid=0101039424 type=event subtype=vpn level=information vd="root" action="tunnel-up" tunneltype="ssl-web" tunnel_id=179308386 remote_ip=123.116.47.242 tunnel_ip=(null) user="lan.liu" group="vpn_usergroup" dst_host="N/A" reason="login successfully" msg="SSL tunnel established" date=2015-01-22 time=13:47:45 logid=0101039943 type=event subtype=vpn level=information vd="root" action="ssl-new-con" tunneltype="ssl" tunnel_id=0 remote_ip=123.116.47.242 tunnel_ip=(null) user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL new connection"

[sensorsinc · Accepted solution]

China recently "upgraded" their Great Firewall and is actively monitoring and blocking VPNs in real-time.

http://techcrunch.com/2015/01/23/china-vpn-crackdown/

http://www.wsj.com/articles/chinas-great-firewall-gets-taller-1422607143

There are VPN providers who are actively working around the issue.  Astrill (https://www.astrill.com) for example is supposed to work on everything but iOS.

I just started my search here to see what FortiNet is doing about it. 

If anyone knows of an official response from FortiNET I would like to hear about it.

Good luck!