sslvpn client not able to connect

[kinmun]

I have 2 users using windows 7 OS and forticlient 5.2.3.0633 not able to login to sslvpn.

it used to work.

now they cannot login.

this is the error.

I m very sure its the forticlient issue. I used my user account n password on one of the user forticlient. it returns the same error.

no issue when I login using my own windows 7 laptop.

should I re-install the forticlient for the 2 users?

[kinmun]

this is the error log from one of the user

22/7/2015 9:44:45 AM Error VPN id=96603 msg="SSLVPN tunnel connection failed (Error=-5)." remotegw=203.208.xxx.xx vpnstate=connected vpntunnel="GV VPN" vpntype=ssl vpnuser=username 22/7/2015 10:40:08 AM Notice FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled" 22/7/2015 10:40:10 AM Notice VPN id=96602 msg="SSLVPN service started successfully." vpntype=ssl 22/7/2015 10:43:55 AM Error VPN id=96603 msg="SSLVPN tunnel connection failed (Error=-8)." remotegw=203.208.xxx.xx vpnstate=connected vpntunnel="GV VPN" vpntype=ssl vpnuser=username2 22/7/2015 10:45:44 AM Error VPN id=96603 msg="SSLVPN tunnel connection failed (Error=-8)." remotegw=203.208.xxx.xx vpnstate=connected vpntunnel=GVVPN vpntype=ssl vpnuser=username2

[elQue]

I don't know if that is related but we had the same error on user side.

The issue was that we only allow TLS1.1 and TLS1.2 connections on the Fortis and Internet Explorer was set to only allow SSLv3.0 and TLS1.0 As soon as strong encryption on clientside was enabled the connection worked.

[Huey]

elQue wrote:

I don't know if that is related but we had the same error on user side.

The issue was that we only allow TLS1.1 and TLS1.2 connections on the Fortis and Internet Explorer was set to only allow SSLv3.0 and TLS1.0 As soon as strong encryption on clientside was enabled the connection worked.

Not sure I understand your fix.  Why would IE SSL settings affect FortiClient?

[gschmitt]

Huey wrote:

Not sure I understand your fix.  Why would IE SSL settings affect FortiClient?

Because the "IE settings" are actually the general OS internet settings, that's why the are listed in the control panel as "Internet Options" 

[elQue]

I'm neither a Microsoft nor a Forticlient professional but I assume that you can change settings on OS level via IE that other applications depend on - like security settings which are now configured via group policy.