Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
michael_lacey
New Contributor

SSL-VPN connects and disconnects straight away

Hi All,

 

I have an SSL-VPN that did work, however now, users connect and straight away disconnect. I have ran a debug and obtained the following (full debug attached)

 

[4832:root:31266]tunnel_state.c:1278 no more addresses available

 

To me this suggests that the IP range for the SSL VPN is full? Currently though I do not have any users on the VPN, is there a way we can clear this?

 

Thanks

 

7 REPLIES 7
Toshi_Esumi
Esteemed Contributor II

Although I don't see your attachment, my guess is about the same as yours for the log. Then I'm wondering what happened between the time "did work" and "now". Did you upgrade the system or change some SSL-VPN related config, or really nothing has happened?

emnoc
Esteemed Contributor III

I had that same issue awhile back in v5.2.3 iirc and it didn't make any sense to me. What I did was to kill the  sslvpn process

 

 

Execute a kill against the proc-id

 

1st run a new diag debug 

 

diag debug application  sslvpn -1

 

2nd

 

fnsysctl cat /var/run/sslvpnd.pid

fnsysctl kill -9 <pid from above>

 

rerun and make sure a new pid comes up

 

3rd

fnsysctl cat /var/run/sslvpnd.pid

 

 

review any diagnostic output ;

 

reference

 

http://socpuppet.blogspot.com/2014/06/how-to-kill-dhcp-daemon-or-any-daemons.html

 

 

PCNSE 

NSE 

StrongSwan  

Toshi_Esumi
Esteemed Contributor II

if a multi-vdom environment

    fnsysctl killall sslvpnd

then

    diag sys top-summary "-i 10"

would be handy.

michael_lacey

Thanks for the responses guys,

 

would blowing away the config and reentering it, or a reboot help in the first instance?

 

not totally comfortable with killing the process as Fortinet do not seem to support it?

 

Thanks

emnoc
Esteemed Contributor III

You can do that  but killing the pid off is what the re-configuration would do also. If you don't want to use fnsyscl you can use  diag sys kill  <killnumber>  <pid#>

 

e.g

 

    diag sys kill  9 20032

 

 

Just make sure a new pid comes up and that would ensured you killed  off  the process.

 

Ken

 

 

PCNSE 

NSE 

StrongSwan  

Toshi_Esumi
Esteemed Contributor II

And, that's what TAC would ask you to do or do it themselves when you open a ticket and don't find anything wrong in the config. It just affects to any ongoing SSL VPN sessions if anything is up, instead of affecting to everybody when you reboot the unit.

vickylahkarbytes
New Contributor

I do not know the Mac OS much, but in windows i solved the same problem the deleting the Fortissl connection in internet options of windows control panel.