SSL VPN DTLS support for FortiClient (macOS) and (Linux) 7.2.2

7.2.2 adds the capability for FortiClient on macOS and Linux to use DTLS to connect to an SSL VPN tunnel. Using TLS for SSL VPN causes performance issues and packet loss. DTLS improves SSL VPN tunnel performance and has less overheard, which improves overall customer experience.

To configure FortiOS for SSL VPN DTLS support for FortiClient:

1. Ensure that UDP traffic is allowed on the FortiGate for ingress and egress ports.
2. Enable DTLS for the SSL VPN tunnel:

   config vpn ssl settings

   set dtls-tunnel enable

   end

To configure EMS for SSL VPN DTLS support for FortiClient:

1. In EMS, go to Endpoint Profiles > Remote Access > SSL VPN.
2. Enable Preferred DTLS Tunnel.

   

To verify that FortiClient uses DTLS for the SSL VPN connection:

1. After FortiClient receives the updated profile from EMS, connect to the SSL VPN tunnel.
2. Verify that FortiClient uses DTLS for the SSL VPN connection using one of the following methods:
   • In Command Prompt, run ip addr and look at the tunnel details. The MTU value for the DTLS tunnel setup should be 1 200:

      fctvpnf50ba67b: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1200 qdisc fq_codel state UP group default qlen 500
         link/none
         inet 10.20.20.1/32 scope global noprefixroute fctvpnf50ba67b
            valid_lft forever preferred_lft forever

   • Verify the DTLS handshakes in the /var/log/forticlient/sslvpn.log file:

     20230809 19:40:24.838 TZ=-0700 [sslvpn:DEBG] dtls_handshake:14 DtlsShowKeyValuePair-->
     20230809 19:40:24.838 TZ=-0700 [sslvpn:DEBG] dtls_handshake:44 pK=0xf57984, pV=0xf57989, K=|type|,V=|heartbeat|
     20230809 19:40:30.846 TZ=-0700 [sslvpn:DEBG] dtls_handshake:14 DtlsShowKeyValuePair-->
     20230809 19:40:30.847 TZ=-0700 [sslvpn:DEBG] dtls_handshake:44 pK=0xf57984, pV=0xf57989, K=|type|,V=|heartbeat|
     20230809 19:40:36.897 TZ=-0700 [sslvpn:DEBG] dtls_handshake:14 DtlsShowKeyValuePair-->
     20230809 19:40:36.898 TZ=-0700 [sslvpn:DEBG] dtls_handshake:44 pK=0xf57984, pV=0xf57989, K=|type|,V=|heartbeat|
     20230809 19:40:42.905 TZ=-0700 [sslvpn:DEBG] dtls_handshake:14 DtlsShowKeyValuePair-->