SSL VPN troubleshooting

This page contains tips to help you with some common challenges for SSL VPN.

  • Enter the following to display debug messages for SSL VPN:
diagnose debug application sslvpn -1

This command enables debugging of SSL VPN with a debug level of -1. The -1 debug level produces detailed results.

  • Enter the following command to verify the debug configuration:
diagnose debug info
debug output: disable
console timestamp: disable
console no user log message: disable
sslvpn debug level: -1 (0xffffffff)
CLI debug level: 3

This output verifies that SSL VPN debugging is enabled with a debug level of -1, and shows what filters are in place. The output above indicates that debug output is disabled, so debug messages are not displayed. The output also indicates that debugging has not been enabled for any software systems.

  • Enter the following to enable displaying debug messages:
diagnose debug enable

To view the debug messages, log into the SSL VPN portal. The CLI displays debug output similar to the following:

FGT60C3G10002814 # [282:root]SSL state:before/accept initialization (172.20.120.12)
[282:root]SSL state:SSLv3 read client hello A (172.20.120.12)
[282:root]SSL state:SSLv3 write server hello A (172.20.120.12)
[282:root]SSL state:SSLv3 write change cipher spec A (172.20.120.12)
[282:root]SSL state:SSLv3 write finished B (172.20.120.12)
[282:root]SSL state:SSLv3 flush data (172.20.120.12)
[282:root]SSL state:SSLv3 read finished A:system lib(172.20.120.12)
[282:root]SSL state:SSLv3 read finished A (172.20.120.12)
[282:root]SSL state:SSL negotiation finished successfully (172.20.120.12)
[282:root]SSL established: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1
  • Enter the following to stop displaying debug messages:
diagnose debug disable

 

The following is a list of potential issues. The suggestions below are not exhaustive, and may not reflect your network topology.

There is no response from the SSL VPN URL.

  • Go to VPN > SSL-VPN Settings and check the SSL VPN port assignment. Also, verify that the SSL VPN policy is configured correctly.
  • Check the URL you are attempting to connect to. It should follow this pattern:
https://<FortiGate IP>:<Port>/remote/login
  • Ensure that you are using the correct port number in the URL.

FortiClient cannot connect.

Read the Release Notes to ensure that the version of FortiClient you are using is compatible with your version of FortiOS.

Tunnel-mode connection shuts down after a few seconds.

This issue can occur when there are multiple interfaces connected to the Internet (for example, a dual WAN). Upgrade to the latest firmware then use the following CLI command:

config vpn ssl settings
   set route-source-interface enable
end

When you attempt to connect using FortiClient or in Web mode, you are returned to the login page, or you receive the following error message: “Unable to logon to the server. Your user name or password may not be configured properly for this connection. (-12).

  • Ensure that cookies are enabled in your browser.
  • If you are using a remote authentication server, ensure that the FortiGate is able to communicate with it.
  • Access to the web portal or tunnel will fail if Internet Explorer has the privacy Internet Options set to High. If set to High, Internet Explorer will block cookies that do not have a compact privacy policy, and that use personally identifiable information without your explicit consent.

You receive an error message stating: “Destination address of Split Tunneling policy is invalid.

The SSL VPN security policy uses the ALL address as its destination. Change the address to that of the protected network instead.

The tunnel connects but there is no communication.

Go to Network > Static Routes and ensure that there is a static route to direct packets destined for the tunnel users to the SSL VPN interface.

You can connect remotely to the VPN tunnel but are unable to access the network resources.

Go to Policy & Objects > IPv4 Policy and examine the policy allowing VPN access to the local network. If the destination address is set to all, create a firewall address for the internal network. Change the destination address and attempt to connect remotely again.

Users are unable to download the SSL VPN plugin.

Go to VPN > SSL-VPN Portals to make sure that the option to Limit Users to One SSL-VPN Connection at a Time is disabled. This allows users to connect to the resources on the portal page while also connecting to the VPN through FortiClient.

Users are being assigned to the wrong IP range.

Ensure that the same IP Pool is used in VPN Portal and VPN Settings to avoid conflicts. If there is a conflict, the portal settings will be used.

Sending tunnel statistics to FortiAnalyzer

By default, logged events include tunnel-up and tunnel-down status events. Other events, by default, will appear in the FortiAnalyzer report as “No Data Available”. More accurate results require logs with action=tunnel-stats, which is used in generating reports on the FortiAnalyzer (rather than the tunnel-up and tunnel-down event logs). The FortiGate does not, by default, send tunnel-stats information.

To allow VPN tunnel-stats to be sent to FortiAnalyzer, configure the FortiGate unit as follows using the CLI:

config system settings
   set vpn-stats-log ipsec ssl
   set vpn-stats-period 300
end

 

Keith Leroux

Keith Leroux

Technical Writer at Fortinet
Keith Leroux is a writer on the FortiOS 'techdocs' team in Ottawa, Ontario. He obtained a Bachelor's degree from Queen's University in English Language and Literature, and a graduate certificate in Technical Writing from Algonquin College. He spent a year teaching ESL in South Korea. Annyeong!
Keith Leroux

Share this recipe:

Facebooktwittergoogle_pluslinkedin

Leave a comment:

Before commenting, please read the site's comment policy. Only questions related to documentation will be answered. For other concerns, please contact Fortinet support.

  • Santosh Sharma

    thanks for this doucment.

    but i request you please make T-shoot document on CLI.

    1. run cli to check if tunnel is down.
    2. check all settings from CLI. and there should be 1 screen shot with correct info and other with what misconfiguration is there with hightlighted.

    3. if tunnel is up and issue is in route then it should be known by cli by running sniff cli . and show the output how it is related to route issue.

    4. if user is getting -12 , -99 error then what would be the CLI output in that case. so that Checking CLI output will let us know the ERROR code and solution should be defined for each after explanation. and all possible output related to misconfiguration should be shown in CLI. so by looking into that message one can rectify the issue.

    please make one on this.

    I was waiting for T-Shoot document since a long time yet also it is not complete.

    GIVE scenerio T-shoot like vdom is configured.

    like as below.==========================================
    ==========================================
    Use flow debugging to figure out what is going wrong:

    c v

    edit root

    dia debug en

    dia debug fl sh con en

    dia debug fl filter addr

    dia debug fl trace start 10

    The trace output should show NAT, routing, policy actions (permit, deny, no open port, etc.), and traffic flow. Make sure you test with a new session or flow debugging will just show fairly meaningless fastpath info

    • Keith Leroux

      Hi Santosh,

      Thank you for your feedback. I’ll try to find some time to update the SSL VPN troubleshooting section, but I can’t guarantee anything in the near future.

      Please know that your comments are much appreciated and we look forward to them. In the meantime, there is a more complete troubleshooting doc available here:
      http://docs.fortinet.com/uploaded/files/2924/troubleshooting-54.pdf

      Cheers~

  • Singh

    Can you please guide me how to setup the configuration of forticlient VPN in windows 10 phone. What is there Servername, password etc.

    • Trevor Campbell

      Hi Singh

      FortiNet do a lot of “How to” cookbooks and Video’s so a quick google search should find something.

      The video’s can be found on video.fortinet.com (sorry I can’t paste the URL)

      Search for
      Remote access With SSL VPN
      and you should find one called
      Remote Access with SSL VPN (Web & Tunnel Mode)
      which would be a good starting point for you.
      Regards
      Trevor.

  • Trevor Campbell

    I’ve just been testing an SSL VPN with user accounts linked to Active Directory using LDAP and found that I also got the “Your user name or password may not be configured properly for this connection. (-12)” error when my test account was accidentally in two AD groups.
    Removing the account from one of the groups fixed this issue for me.

    • Kerrie Newton

      Hello Trevor,

      When specifying the LDAP settings in the user group are you specifying a path or leaving the query open?

      Regards,
      Kerrie

      • Trevor Campbell

        Hi Kerrie
        On the FortiGate we have a couple of the groups that are used to control access to specific SSL VPN portals.
        Each group is configured as type “Firewall” and linked to a single group in AD using an LDAP “remote server” – ie: the specific group was selected from the LDAP groups table.
        What I found was that when I accidentally had my AD account in two of the AD groups I got the error 12.
        As soon as I took the account out of one of the groups I could login with no problems.
        Regards
        Trevor.

        • Kerrie Newton

          Happy your issue has been resolved!

  • Esther Wong

    Hi,

    I have been setup the fortigate SSL VPN by following the SSL VPN video 5.4.

    I can connect with forticlient, i can ping the workstation but i cannot RDP the server.

    How can I check if I have do anything wrong?

    I have already checked the policy. And it should be correct.

    • Victoria Martin

      Hi Esther,

      I would suggest that you contact Fortinet Support for more help with this issue. For information about working with support, that you can find at http://cookbook.fortinet.com/how-to-work-with-fortinet-support/

      • Esther Wong

        Thanks Victoria. I will contact Fortinet support for that! Thanks.

  • Eric

    I have a dual-wan setup using ECMP spillover – port4 primary, wan1 secondary. I have implemented the set route-source-interface enable setting as referenced in your article. However, the return path is attempting to go out port4. Is there a way around this issue? I have a ticket open with Fortinet support, but so far they are stumped.

    59.434291 wan1 in External_IP.63776 -> 10.0.0.2.10443: syn 1807050153
    59.434369 port4 out 10.0.0.2.10443 -> External_IP.63776: syn 3247072270 ack 1807050154

    • Victoria Martin

      Hi Eric,

      Support is going to be the best place to get an answer about this, hopefully they can get it sorted out.

  • Daniel Valera Moret

    Hi. I have a VPN SSL configuration but de VoIP service not work well… In the sense Jabber (VPN) – Local host if the phone rings but the voice is not heard … in the opposite direction nor does the telephone ring. The other services on the VPN work well

  • Sathish s

    Hi,
    I have SSL vpn to fortigate to manage the device remotely, my customer wants only use the inside lp to access the firewall , not the WAN ip which is being used for connecting SSL vpn.
    I am able to access the inside LAN interface using SSH and able to ping the interface after connecting the ssl vpn from internet.
    BUT unable to https,
    I have rule configured , please let me know if anything else to be configured.

    Please help,

  • Ankur Aggarwal

    https://uploads.disquscdn.com/images/87b4d4731c92accb67c53231d5b4ca3c757a58b8f0d426e9b90110a44651a2cd.png Hi…
    there is problem with the forticlient as it is not working on some of the systems tryng to connecet to corporate office using ssl vpn through forticlient. The gateway:ip and port:443 is configured correctly but some of the users are getting the error (-5) the vpn server may be unreachable but then most of the users can connect without any issues. please suggest on this problem.

  • Basavaraj

    There is problem with Forticliet….connecting through application after connecting corporate site default gateway not showing… tired to connecting over SSL and without SSL…,please suggest on this issue..,,