SSL VPN troubleshooting


This page contains tips to help you with some common challenges for SSL VPN.

  • Enter the following to display debug messages for SSL VPN:
diagnose debug application sslvpn -1

This command enables debugging of SSL VPN with a debug level of -1. The -1 debug level produces detailed results.

  • Enter the following command to verify the debug configuration:
diagnose debug info
debug output: disable
console timestamp: disable
console no user log message: disable
sslvpn debug level: -1 (0xffffffff)
CLI debug level: 3

This output verifies that SSL VPN debugging is enabled with a debug level of -1, and shows what filters are in place. The output above indicates that debug output is disabled, so debug messages are not displayed. The output also indicates that debugging has not been enabled for any software systems.

  • Enter the following to enable displaying debug messages:
diagnose debug enable

To view the debug messages, log into the SSL VPN portal. The CLI displays debug output similar to the following:

FGT60C3G10002814 # [282:root]SSL state:before/accept initialization (
[282:root]SSL state:SSLv3 read client hello A (
[282:root]SSL state:SSLv3 write server hello A (
[282:root]SSL state:SSLv3 write change cipher spec A (
[282:root]SSL state:SSLv3 write finished B (
[282:root]SSL state:SSLv3 flush data (
[282:root]SSL state:SSLv3 read finished A:system lib(
[282:root]SSL state:SSLv3 read finished A (
[282:root]SSL state:SSL negotiation finished successfully (
[282:root]SSL established: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1
  • Enter the following to stop displaying debug messages:
diagnose debug disable


The following is a list of potential issues. The suggestions below are not exhaustive, and may not reflect your network topology.

There is no response from the SSL VPN URL.

  • Go to VPN > SSL-VPN Settings and check the SSL VPN port assignment. Also, verify that the SSL VPN policy is configured correctly.
  • Check the URL you are attempting to connect to. It should follow this pattern:
https://<FortiGate IP>:<Port>/remote/login
  • Ensure that you are using the correct port number in the URL.

FortiClient cannot connect.

Read the Release Notes to ensure that the version of FortiClient you are using is compatible with your version of FortiOS.

Tunnel-mode connection shuts down after a few seconds.

This issue can occur when there are multiple interfaces connected to the Internet (for example, a dual WAN). Upgrade to the latest firmware then use the following CLI command:

config vpn ssl settings
   set route-source-interface enable

When you attempt to connect using FortiClient or in Web mode, you are returned to the login page, or you receive the following error message: “Unable to logon to the server. Your user name or password may not be configured properly for this connection. (-12).

  • Ensure that cookies are enabled in your browser.
  • If you are using a remote authentication server, ensure that the FortiGate is able to communicate with it.
  • Access to the web portal or tunnel will fail if Internet Explorer has the privacy Internet Options set to High. If set to High, Internet Explorer will block cookies that do not have a compact privacy policy, and that use personally identifiable information without your explicit consent.

You receive an error message stating: “Destination address of Split Tunneling policy is invalid.

The SSL VPN security policy uses the ALL address as its destination. Change the address to that of the protected network instead.

The tunnel connects but there is no communication.

Go to Network > Static Routes and ensure that there is a static route to direct packets destined for the tunnel users to the SSL VPN interface.

You can connect remotely to the VPN tunnel but are unable to access the network resources.

Go to Policy & Objects > IPv4 Policy and examine the policy allowing VPN access to the local network. If the destination address is set to all, create a firewall address for the internal network. Change the destination address and attempt to connect remotely again.

Users are unable to download the SSL VPN plugin.

Go to VPN > SSL-VPN Portals to make sure that the option to Limit Users to One SSL-VPN Connection at a Time is disabled. This allows users to connect to the resources on the portal page while also connecting to the VPN through FortiClient.

Users are being assigned to the wrong IP range.

Ensure that the same IP Pool is used in VPN Portal and VPN Settings to avoid conflicts. If there is a conflict, the portal settings will be used.

Sending tunnel statistics to FortiAnalyzer

By default, logged events include tunnel-up and tunnel-down status events. Other events, by default, will appear in the FortiAnalyzer report as “No Data Available”. More accurate results require logs with action=tunnel-stats, which is used in generating reports on the FortiAnalyzer (rather than the tunnel-up and tunnel-down event logs). The FortiGate does not, by default, send tunnel-stats information.

To allow VPN tunnel-stats to be sent to FortiAnalyzer, configure the FortiGate unit as follows using the CLI:

config system settings
   set vpn-stats-log ipsec ssl
   set vpn-stats-period 300


Keith Leroux

Keith Leroux

Technical Writer at Fortinet
Keith Leroux is a writer on the FortiOS 'techdocs' team in Ottawa, Ontario. He obtained a Bachelor's degree from Queen's University in English Language and Literature, and a graduate certificate in Technical Writing from Algonquin College. He spent a year teaching ESL in South Korea. Annyeong!
Keith Leroux

Latest posts by Keith Leroux (see all)

  • Was this helpful?
  • Yes   No
  • nguyễn duy thiện

    Hi there
    I config SSL VPN use Tunnel and web access, but when i connect by Forticlient it get error, can you help me to resolve

    thanks and regards

  • Laura

    Hello, I have a FGT90E that disconnect idle vpn users randomly (Setting is set to 3600sec). Sometimes it just disconnect them a few second after get connected. Is there any troubleshooting process to see whay that’s happens?
    Thanks in advance!

    • Keith Leroux

      Hello Laura,

      Could you try disabling “Idle Logout” (under ‘SSL-VPN Settings’), and see if users are still getting disconnected?

      • Laura

        Idle logout is disabled and the problem is happening also for people connected to a server behind the fortigate. They don’t use VPN and configuration in the server seems to be ok…

        Thanks for your reply!

  • Basavaraj

    There is problem with Forticliet….connecting through application after connecting corporate site default gateway not showing… tired to connecting over SSL and without SSL…,please suggest on this issue..,,

  • Ankur Aggarwal Hi…
    there is problem with the forticlient as it is not working on some of the systems tryng to connecet to corporate office using ssl vpn through forticlient. The gateway:ip and port:443 is configured correctly but some of the users are getting the error (-5) the vpn server may be unreachable but then most of the users can connect without any issues. please suggest on this problem.

  • Sathish s

    I have SSL vpn to fortigate to manage the device remotely, my customer wants only use the inside lp to access the firewall , not the WAN ip which is being used for connecting SSL vpn.
    I am able to access the inside LAN interface using SSH and able to ping the interface after connecting the ssl vpn from internet.
    BUT unable to https,
    I have rule configured , please let me know if anything else to be configured.

    Please help,

  • Daniel Valera Moret

    Hi. I have a VPN SSL configuration but de VoIP service not work well… In the sense Jabber (VPN) – Local host if the phone rings but the voice is not heard … in the opposite direction nor does the telephone ring. The other services on the VPN work well

  • Eric

    I have a dual-wan setup using ECMP spillover – port4 primary, wan1 secondary. I have implemented the set route-source-interface enable setting as referenced in your article. However, the return path is attempting to go out port4. Is there a way around this issue? I have a ticket open with Fortinet support, but so far they are stumped.

    59.434291 wan1 in External_IP.63776 -> syn 1807050153
    59.434369 port4 out -> External_IP.63776: syn 3247072270 ack 1807050154

    • Victoria Martin

      Hi Eric,

      Support is going to be the best place to get an answer about this, hopefully they can get it sorted out.

    • Valery Zhurbenko

      Hi Eric. We have same issue with wan1 and wan2.
      SSL configured to accept connections on wan1, but responses goes via wan2.. troubleshooting not help.
      What solution you got from support?

      • Eric

        It was determined to be an old bug that popped back up again in the FortiOS we were running (5.2.9). We upgrade to 5.2.10, which resolved the issue.

  • Esther Wong


    I have been setup the fortigate SSL VPN by following the SSL VPN video 5.4.

    I can connect with forticlient, i can ping the workstation but i cannot RDP the server.

    How can I check if I have do anything wrong?

    I have already checked the policy. And it should be correct.

    • Victoria Martin

      Hi Esther,

      I would suggest that you contact Fortinet Support for more help with this issue. For information about working with support, that you can find at

      • Esther Wong

        Thanks Victoria. I will contact Fortinet support for that! Thanks.

  • Trevor Campbell

    I’ve just been testing an SSL VPN with user accounts linked to Active Directory using LDAP and found that I also got the “Your user name or password may not be configured properly for this connection. (-12)” error when my test account was accidentally in two AD groups.
    Removing the account from one of the groups fixed this issue for me.

    • Kerrie Newton

      Hello Trevor,

      When specifying the LDAP settings in the user group are you specifying a path or leaving the query open?


      • Trevor Campbell

        Hi Kerrie
        On the FortiGate we have a couple of the groups that are used to control access to specific SSL VPN portals.
        Each group is configured as type “Firewall” and linked to a single group in AD using an LDAP “remote server” – ie: the specific group was selected from the LDAP groups table.
        What I found was that when I accidentally had my AD account in two of the AD groups I got the error 12.
        As soon as I took the account out of one of the groups I could login with no problems.

        • Kerrie Newton

          Happy your issue has been resolved!

  • Singh

    Can you please guide me how to setup the configuration of forticlient VPN in windows 10 phone. What is there Servername, password etc.

    • Trevor Campbell

      Hi Singh

      FortiNet do a lot of “How to” cookbooks and Video’s so a quick google search should find something.

      The video’s can be found on (sorry I can’t paste the URL)

      Search for
      Remote access With SSL VPN
      and you should find one called
      Remote Access with SSL VPN (Web & Tunnel Mode)
      which would be a good starting point for you.

  • Santosh Sharma

    thanks for this doucment.

    but i request you please make T-shoot document on CLI.

    1. run cli to check if tunnel is down.
    2. check all settings from CLI. and there should be 1 screen shot with correct info and other with what misconfiguration is there with hightlighted.

    3. if tunnel is up and issue is in route then it should be known by cli by running sniff cli . and show the output how it is related to route issue.

    4. if user is getting -12 , -99 error then what would be the CLI output in that case. so that Checking CLI output will let us know the ERROR code and solution should be defined for each after explanation. and all possible output related to misconfiguration should be shown in CLI. so by looking into that message one can rectify the issue.

    please make one on this.

    I was waiting for T-Shoot document since a long time yet also it is not complete.

    GIVE scenerio T-shoot like vdom is configured.

    like as below.==========================================
    Use flow debugging to figure out what is going wrong:

    c v

    edit root

    dia debug en

    dia debug fl sh con en

    dia debug fl filter addr

    dia debug fl trace start 10

    The trace output should show NAT, routing, policy actions (permit, deny, no open port, etc.), and traffic flow. Make sure you test with a new session or flow debugging will just show fairly meaningless fastpath info

    • Keith Leroux

      Hi Santosh,

      Thank you for your feedback. I’ll try to find some time to update the SSL VPN troubleshooting section, but I can’t guarantee anything in the near future.

      Please know that your comments are much appreciated and we look forward to them. In the meantime, there is a more complete troubleshooting doc available here: