Description
This article describes how to troubleshoot various SSL VPN issues.
Scope
FortiGate v6.4.x, v7.0.x,.v72.x, v7.4.x, up to v7.6.2.
Solution
Note:
Starting in FortiOS 7.6.3, the SSL VPN tunnel mode feature is replaced with IPsec VPN tunnel, where users will be able to configure IPsec to use TCP port 443 for communication.
SSL VPN debug command.
Use the following diagnostic commands to identify SSL VPN issues. These commands enable debugging of SSL VPN with a debug level of -1 for detailed results.
diagnose debug dis
diagnose debug reset
diagnose vpn ssl debug-filter src-addr4 x.x.x.x
diagnose debug application sslvpn -1
diagnose debug application tvc -1
diagnose debug console timestamp enable
diagnose debug enable
To clear the filter, enter the following command:
diagnose vpn ssl debug-filter clear
More details about the TVC (Tunnel Virtual Connection) process: Technical Tip: Debugging SSL VPN Using TVC on FortiGate.
Note:
x.x.x.x should be the public IP of the connecting user. The filter will ensure that the debug information relevant only to traffic from the specified IP address is captured, helping to focus on specific client troubleshooting.
The CLI displays debug output similar to the following:
[282:root]SSL state:before/accept initialization (172.20.120.12)
[282:root]SSL state:SSLv3 read client hello A (172.20.120.12)
[282:root]SSL state:SSLv3 write server hello A (172.20.120.12)
[282:root]SSL state:SSLv3 write change cipher spec A (172.20.120.12)
[282:root]SSL state:SSLv3 write finished B (172.20.120.12)
[282:root]SSL state:SSLv3 flush data (172.20.120.12)
[282:root]SSL state:SSLv3 read finished A:system lib(172.20.120.12)
[282:root]SSL state:SSLv3 read finished A (172.20.120.12)
[282:root]SSL state:SSL negotiation finished successfully (172.20.120.12)
[282:root]SSL established: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1
To disable the debug.
diagnose debug disable
diagnose debug reset
Remote user authentication debug command.
Use the following diagnose commands to identify remote user authentication issues.
diagnose debug application fnbamd -1
diagnose debug enable
Use the following diagnose commands to identify SAML user authentication issues.
diagnose debug application samld -1
diagnose debug enable
Troubleshooting common issues:
To troubleshoot getting no response from the SSL VPN URL:
Note:
Starting from v7.4, SSL VPN GUI menu visibility is disabled by default. If SSL VPN web mode and tunnel mode were configured in a FortiOS firmware version before upgrading to FortiOS v7.4.1 and above, then the VPN -> SSL-VPN menus and SSL VPN web mode settings will remain visible in the GUI.
To enable the SSL VPN GUI menu, go to System -> Feature Visibility and toggle the SSL VPN radio button.
- Go to VPN -> SSL-VPN Settings. Check the SSL VPN port assignment. Make sure the port number does not conflict with HTTPS or Virtual IPs.
- Check the restrict access setting to ensure there is no restriction for hosts trying to connect.
- Go to Policy & Objects -> Firewall Policy. Check that the policy for SSL VPN traffic is configured correctly.
- From v7.6.x and above the User/Group option has been moved to a separate dedicated field as shown below:
- Check the URL to connect to. It follows this pattern: https://<FortiGate IP>:<Port>. Check the correct port number in the URL is used. Ensure FortiGate is reachable from the computer.
- Ping <FortiGate IP> to see if it is reachable (If PING is enabled on the FortiGate interface).
- Check that the browser has enabled TLS 1.1, TLS 1.2, and TLS 1.3.
- When using FQDN to connect, make sure it resolves to the IP address of the FortiGate correctly.
- Check local-in-policy in the FortiGate CLI by running 'show firewall local-in-policy'.
To troubleshoot FortiGate connection issues.
- Check the Release Notes to ensure that the FortiClient version is compatible with the version of FortiOS.
FortiClient uses IE security setting, In IE Internet options -> Advanced -> Security, check that Use TLS 1.1 and Use TLS 1.2 are enabled. - Check that SSL VPN 'ip-pools' have free IPs to sign out. The default 'ip-pools' SSLVPN_TUNNEL_ADDR1 has 10 IP addresses. Export and check FortiClient debug logs. Go to File -> Settings. In the Logging section, enable Export logs. Set the Log Level to Debug and select Clear logs. Try to connect to the VPN. When a connection error is detected, select 'Export logs'.
- If the SSL VPN is not established, it is also essential to verify if the connection packets are reaching the FortiGate, by using a sniffer:
diagnose sniffer packet any 'port XXXXX and host y.y.y.y' 4 0 l
Where 'XXXXX' is the port used for the SSL VPN connection (10443 for instance) and 'y.y.y.y' is the public IP of the user trying to connect to the SSL VPN. If the SSL VPN no packets reach the FortiGate, verifying the port forwarding configuration in the modem or with the ISP is necessary.
To troubleshoot SSL VPN hanging or disconnecting at 48%.
- Negotiation stops at this percentage if there is an issue with Authentication or two-factor authentication.
- If negotiation stops at this percentage with the error 'Credential or SSL VPN configuration is wrong (-7200)', recheck the credentials.
- To resolve the 'Credential or SSL VPN configuration is wrong (-7200)' error, follow the steps in this article: Troubleshooting Tip: When logging in with SSL VPN, the error 'Credential or SSLVPN configuration is ....
To troubleshoot SSL VPN hanging or disconnecting at 98%.
A new SSL VPN driver was added to FortiClient 5.6.0 and later to resolve SSL VPN connection issues. If the FortiOS version is compatible, upgrade to use one of these versions. Latency or poor network connectivity can cause login timeout on FortiGate. In v5.6.0 and later, use the following commands to allow a user to increase the SSL VPN login timeout setting.
config vpn ssl settings
set login-timeout 180 (default is 30)
set dtls-hello-timeout 60 (default is 10)
end
To troubleshoot tunnel mode connections shutting down after a few seconds.
This happens if there are multiple interfaces connected to the Internet, for example, SD-WAN. This can cause the session to become 'dirty'.
To allow multiple interfaces to connect, use the following CLI commands.
For v6.0.1 or later.
config system interface
edit <name>
set preserve-session-route enable
next
end
Note: preserve-session-route enable uses its preserve route on a particular ISP.
For example: when network changes are made, it keep the routes on the same WAN interface for that session.
For v6.0.0 or earlier.
config vpn ssl settings
set route-source-interface enable
end
To troubleshoot users being assigned to the wrong IP range.
Go to VPN -> SSL-VPN Portals and VPN -> SSL-VPN Settings and ensure the same IP pool is used in both places. Using the same IP Pool prevents conflicts. If there is a conflict, the portal settings are used.
To troubleshoot SSL VPN traffic is getting denied with implicit deny.
Ensure that the user is a member of the correct group. The group is configured correctly on the Firewall Policy.
get vpn ssl monitor | grep <PC Public IP> <----- Change <PC Public IP> to the PC Public IP address.
get vpn ssl monitor
SSL-VPN Login Users:
|Index|User|Group|Auth Type|Idle-Timeout|Auth-Timeout|From|HTTP in/out|HTTPS in/out|Two-factor Auth|
|0|nathan_1|Local_Group|1(1)|243|28743|172.xxx.xxx.xxx|0/0|0/0|0|
show firewall policy | grep ssl.root -f
config firewall policy
edit 7
set name "SSLVPN"
set srcintf "ssl.root" <---
set dstintf "port2"
set action accept
set srcaddr "all"
set dstaddr "10.218.0.0_24"
set schedule "always"
set service "ALL"
set groups "Local_Group"
next
end
To troubleshoot slow SSL VPN throughput.
Many factors can contribute to slow throughput.
This recommendation aims to improve throughput by using the FortiOS Datagram Transport Layer Security (DTLS) tunnel option, available in FortiOS v5.4 and above.
DTLS allows SSL VPN to encrypt traffic using TLS and uses UDP as the transport layer instead of TCP. This avoids retransmission problems that can occur with TCP-in-TCP.
FortiClient v5.4.0 to v5.4.3 uses DTLS by default.
FortiClient v5.4.4 and later uses normal TLS, regardless of the DTLS setting on the FortiGate.
To use DTLS with FortiClient:
Go to File -> Settings and enable 'Preferred DTLS Tunnel'.
To enable the DTLS tunnel on FortiGate, use the following CLI commands.
config vpn ssl settings
set dtls-tunnel enable <----- Default setting in SSL VPN.
end
Too many failed login attempts (brute force) can cause high resource consumption and slow performance. To prevent it, do the following:
- Allow SSL VPN connection from certain countries only
- Disable web mode
- It is also possible to automatically block failed logins using an automation stitch. However, it may also block legitimate users if they enter the wrong credentials. Refer to this article: Technical Tip: How to permanently block SSL VPN failed logins using an Automation Stitch.
Additionally, to check the basic SSL VPN statistics, run the following command with the proper parameter:
diagnose vpn ssl [list/info/statistics/debug-filter/hw-acceleration-status]
- list: for current connections.
- info: for general information.
- statistics: for memory usage, concurrent and maximum connections.
- hw-acceleration-status: for the hardware acceleration status.
Notes:
- From v7.2.1 and later versions, SSL VPN Hardware acceleration has been removed.
- Starting from v7.2.6+, v7.4.1+ and v7.6.0 the 'diag vpn ssl' command has additional options:
V7.2.6+:
[list/mux/mux-stat/statistics/tunnel-test/web-mode-test/saml-metadata/info/blocklist/debug-filter/client]
V7.4.1+:
[list/mux/mux-stat/statistics/tunnel-test/web-mode-test/saml-metadata/info/blocklist/dist-usr/peer-name/usr-chg/debug-filter/client]
For slow file transfer issues, refer to Troubleshooting Tip: Error 'SSL-VPN slow file transfer issue'.
Note:
SSL VPN is no longer supported on FortiGate with 2 GB RAM or less, starting from v7.6.0 and above.
Migrate SSL VPN to IPsec VPN:
Related document:
SSL VPN removed from 2GB RAM models for tunnel and web mode
To confirm if a FortiGate has 2 GB RAM or less, enter the command 'diagnose hardware sysinfo conserve' in CLI. If the total RAM is less than 2000 MB, it means the device has 2 GB RAM or less.
Related articles:
Troubleshooting Tip: SSL VPN fails at 98%
Technical Tip: Unable to establish the VPN connection: 'The VPN server may be unreachable. (-5053)
Troubleshooting Tip: How to workaround the VPN error 'Unable to establish the VPN connection . The V...
Release notes of version 7.6.3
Troubleshooting Tip: When logging in with SSL VPN, the error 'Credential or SSLVPN configuration is ...
