DTLS support

FortiOS Datagram Transport Layer Security (DTLS) allows SSL VPN to encrypt traffic using TLS and uses UDP as the transport layer instead of TCP. This avoids retransmission problems that can occur with TCP-in-TCP.

To establish a client SSL VPN connection with DTLS to the FortiGate:

1. Enable the DTLS tunnel in the CLI:

   config vpn ssl setting
       set dtls-tunnel enable
   end

2. Configure the SSL VPN settings (see SSL VPN full tunnel for remote user).

3. Configure the firewall policy (see Firewall policy).

4. In FortiClient, use the Preferred DTLS Tunnel option to connect to SSL VPN with DTLS:

   1. Go to Settings and expand the VPN Options section.

   2. Enable Preferred DTLS Tunnel.

      FortiClient 5.4.0 to 5.4.3 uses DTLS by default. FortiClient 5.4.4 and later uses normal TLS, regardless of the DTLS setting on the FortiGate.

   3. Click Save.

5. In FortiOS, run diagnostics to ensure the SSL VPN connection is established with DTLS:

   # diagnose debug application sslvpn -1
   # diagnose debug enable
   

   The system displays a response like the following:

   [304:vdom1:7]DTLS established: DTLSv1 ECDHE-RSA-AES256-GCM-SHA384