Android phone forticlient vpn issue

[ssos]

When an Android phone uses FortiClient to connect to a VPN,

the connection is successfully established but then automatically disconnects after 2 ~ 3 seconds.

Do you know a solution, or is there anyone experiencing similar symptoms?

forticlient version : 7.2.1.0118

android phone :

one ui 5.1 / andriod 13

one ui 6.0 / android 14

fortigate debug

[13525:root:76f5]allocSSLConn:264 sconn 0x7f30c0541400 (0:root)
[13525:root:76f5]SSL state:before/accept initialization (106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 read client hello A (106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 write server hello A (106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 write certificate A (106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 write key exchange A (106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 write server done A (106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 flush data (106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 read client certificate A (106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 read client key exchange A:system lib(106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 read client key exchange A:system lib(106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 read client key exchange A (106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 read certificate verify A (106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 read finished A (106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 write session ticket A (106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 write change cipher spec A (106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 write finished A (106.x.x.x)
[13525:root:76f5]SSL state:SSLv3 flush data (106.x.x.x)
[13525:root:76f5]SSL state:SSL negotiation finished successfully (106.x.x.x)
[13525:root:76f5]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
[13525:root:76f5]req: /remote/info?lang=en&realm=
[13525:root:76f5]req: /remote/login?lang=en&realm=
[13525:root:76f5]rmt_web_auth_info_parser_common:418 no session id in auth info
[13525:root:76f5]rmt_web_get_access_cache:729 invalid cache, ret=4103
[13525:root:76f5]req: /remote/logincheck
[13525:root:76f5]rmt_web_auth_info_parser_common:418 no session id in auth info
[13525:root:76f5]rmt_web_access_check:667 access failed, uri=[/remote/logincheck],ret=4103,
[13525:root:76f5]sslvpn_auth_check_usrgroup:1752 forming user/group list from policy.
[13525:root:76f5]sslvpn_auth_check_usrgroup:1790 got user (1) group (3:0).
[13525:root:76f5]sslvpn_validate_user_group_list:1423 validating with SSL VPN authentication rules (4), realm ().
[13525:root:76f5]sslvpn_validate_user_group_list:1471 checking rule 2 cipher.
[13525:root:76f5]sslvpn_validate_user_group_list:1479 checking rule 2 realm.
[13525:root:76f5]sslvpn_validate_user_group_list:1490 checking rule 2 source intf.
[13525:root:76f5]sslvpn_validate_user_group_list:1527 checking rule 2 vd source intf.
[13525:root:76f5]sslvpn_validate_user_group_list:1600 rule 2 done, got user (0) group (0:0).
[13525:root:76f5]sslvpn_validate_user_group_list:1471 checking rule 9 cipher.
[13525:root:76f5]sslvpn_validate_user_group_list:1479 checking rule 9 realm.
[13525:root:76f5]sslvpn_validate_user_group_list:1490 checking rule 9 source intf.
[13525:root:76f5]sslvpn_validate_user_group_list:1600 rule 9 done, got user (0) group (1:0).
[13525:root:76f5]sslvpn_validate_user_group_list:1471 checking rule 5 cipher.
[13525:root:76f5]sslvpn_validate_user_group_list:1479 checking rule 5 realm.
[13525:root:76f5]sslvpn_validate_user_group_list:1490 checking rule 5 source intf.
[13525:root:76f5]sslvpn_validate_user_group_list:1600 rule 5 done, got user (1) group (1:0).
[13525:root:76f5]sslvpn_validate_user_group_list:1471 checking rule 4 cipher.
[13525:root:76f5]sslvpn_validate_user_group_list:1479 checking rule 4 realm.
[13525:root:76f5]sslvpn_validate_user_group_list:1490 checking rule 4 source intf.
[13525:root:76f5]sslvpn_validate_user_group_list:1600 rule 4 done, got user (1) group (2:0).
[13525:root:76f5]sslvpn_validate_user_group_list:1688 got user (1), group (3:0).
[13525:root:76f5]two factor check for test_id: off
[13525:root:76f5]sslvpn_authenticate_user:168 authenticate user: [test_id]
[13525:root:76f5]sslvpn_authenticate_user:175 create fam state
[13525:root:76f5]fam_auth_send_req:532 with server blacklist:
[13525:root:76f5]fam_auth_send_req_internal:420 fnbam_auth return: 4
[13525:root:76f5]fam_auth_send_req:532 with server blacklist: #ldap-master
[13525:root:76f5]fam_auth_send_req_internal:420 fnbam_auth return: 4
[13525:root:76f5]Auth successful for group test_group
[13525:root:76f5]fam_do_cb:469 fnbamd return auth success.
[13525:root:76f5]SSL VPN login matched rule (4).
[13525:root:76f5]rmt_web_session_create:734 create web session, idx[11]
[13525:root:76f5]login_succeeded:381 redirect to hostcheck
[13525:root:76f5]deconstruct_session_id:363 decode session id ok, user=[test_id],group=[test_group],portal=[full-access],host=[106.x.x.x],realm=[],idx=11,auth=16,sid=3897beae, login=1707280851, access=1707280851
[13525:root:76f5]deconstruct_session_id:363 decode session id ok, user=[test_id],group=[test_group],portal=[full-access],host=[106.x.x.x],realm=[],idx=11,auth=16,sid=3897beae, login=1707280851, access=1707280851
[13525:root:76f5]deconstruct_session_id:363 decode session id ok, user=[test_id],group=[test_group],portal=[full-access],host=[106.x.x.x],realm=[],idx=11,auth=16,sid=3897beae, login=1707280851, access=1707280851
[13525:root:76f6]allocSSLConn:264 sconn 0x7f30c0544c00 (0:root)
[13525:root:76f6]SSL state:before/accept initialization (106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 read client hello A (106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 write server hello A (106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 write certificate A (106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 write key exchange A (106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 write server done A (106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 flush data (106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 read client certificate A (106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 read client key exchange A:system lib(106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 read client key exchange A:system lib(106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 read client key exchange A (106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 read certificate verify A (106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 read finished A (106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 write session ticket A (106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 write change cipher spec A (106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 write finished A (106.x.x.x)
[13525:root:76f6]SSL state:SSLv3 flush data (106.x.x.x)
[13525:root:76f6]SSL state:SSL negotiation finished successfully (106.x.x.x)
[13525:root:76f6]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
[13525:root:76f6]req: /remote/fortisslvpn
[13525:root:76f6]deconstruct_session_id:363 decode session id ok, user=[test_id],group=[test_group],portal=[full-access],host=[106.x.x.x],realm=[],idx=11,auth=16,sid=3897beae, login=1707280851, access=1707280851
[13525:root:76f6]deconstruct_session_id:363 decode session id ok, user=[test_id],group=[test_group],portal=[full-access],host=[106.x.x.x],realm=[],idx=11,auth=16,sid=3897beae, login=1707280851, access=1707280851
[13525:root:76f7]allocSSLConn:264 sconn 0x7f30c07d8400 (0:root)
[13525:root:76f7]SSL state:before/accept initialization (106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 read client hello A (106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 write server hello A (106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 write certificate A (106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 write key exchange A (106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 write server done A (106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 flush data (106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 read client certificate A (106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 read client key exchange A:system lib(106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 read client key exchange A:system lib(106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 read client key exchange A (106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 read certificate verify A (106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 read finished A (106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 write session ticket A (106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 write change cipher spec A (106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 write finished A (106.x.x.x)
[13525:root:76f7]SSL state:SSLv3 flush data (106.x.x.x)
[13525:root:76f7]SSL state:SSL negotiation finished successfully (106.x.x.x)
[13525:root:76f7]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
[13525:root:76f7]req: /remote/fortisslvpn_xml
[13525:root:76f7]deconstruct_session_id:363 decode session id ok, user=[test_id],group=[test_group],portal=[full-access],host=[106.x.x.x],realm=[],idx=11,auth=16,sid=3897beae, login=1707280851, access=1707280851
[13525:root:76f7]deconstruct_session_id:363 decode session id ok, user=[test_id],group=[test_group],portal=[full-access],host=[106.x.x.x],realm=[],idx=11,auth=16,sid=3897beae, login=1707280851, access=1707280851
[13525:root:76f7]sslvpn_reserve_dynip:1079 tunnel vd[root] ip[10.100.250.12] app session idx[10]
[13525:root:76f7]SSL state:warning close notify (106.x.x.x)
[13525:root:76f7]sslConnGotoNextState:297 error (last state: 1, closeOp: 0)
[13525:root:76f7]Destroy sconn 0x7f30c07d8400, connSize=14. (root)
[13525:root:76f8]allocSSLConn:264 sconn 0x7f30c07d8400 (0:root)
[13525:root:76f8]SSL state:before/accept initialization (106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 read client hello A (106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 write server hello A (106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 write certificate A (106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 write key exchange A (106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 write server done A (106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 flush data (106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 read client certificate A (106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 read client key exchange A:system lib(106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 read client key exchange A:system lib(106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 read client key exchange A (106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 read certificate verify A (106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 read finished A (106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 write session ticket A (106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 write change cipher spec A (106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 write finished A (106.x.x.x)
[13525:root:76f8]SSL state:SSLv3 flush data (106.x.x.x)
[13525:root:76f8]SSL state:SSL negotiation finished successfully (106.x.x.x)
[13525:root:76f8]SSL established: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
[13525:root:76f8]req: /remote/sslvpn-tunnel2?uuid=03D54FE12AE54
[13525:root:76f8]def: (nil) /remote/sslvpn-tunnel2
[13525:root:76f8]req:
[13525:root:76f8]Invalid method in request .

[13525:root:76f8]sslConnGotoNextState:297 error (last state: 1, closeOp: 0)
[13525:root:76f8]Destroy sconn 0x7f30c07d8400, connSize=14. (root)
[13525:root:76f6]req: /remote/logout
[13525:root:76f6]deconstruct_session_id:363 decode session id ok, user=[test_id],group=[test_group],portal=[full-access],host=[106.x.x.x],realm=[],idx=11,auth=16,sid=3897beae, login=1707280851, access=1707280851
[13525:root:76f6]session removed s: 0x7f30c0544c00 (root)
[13525:root:76f6]deconstruct_session_id:363 decode session id ok, user=[test_id],group=[test_group],portal=[full-access],host=[106.x.x.x],realm=[],idx=11,auth=16,sid=3897beae, login=1707280851, access=1707280851
[13525:root:0]sslvpn_internal_remove_one_web_session:2616 web session (root:test_id:test_group:106.x.x.x:11 0) removed for
[13525:root:0]sslvpn_internal_remove_apsession_by_idx:2138 free app session, idx[10]
[13525:root:76f5]rmt_check_conn_session:1922 delete connection 0x7f30c0541400 w/ web session 11
[13525:root:76f5]Destroy sconn 0x7f30c0541400, connSize=13. (root)
[13525:root:76f6]rmt_check_conn_session:1922 delete connection 0x7f30c0544c00 w/ web session 11
[13525:root:76f6]Destroy sconn 0x7f30c0544c00, connSize=12. (root)

[AEK]

Hello

Your issue looks like the below known issue, which is now fixed in FOS 7.0.14 and 7.2.6.

894704

FortiOS check would block iOS and Android mobile devices from connecting to the SSL VPN tunnel.