SSL VPN troubleshooting

SSL VPN debug command

Use the following diagnose commands to identify SSL VPN issues. These commands enable debugging of SSL VPN with a debug level of -1 for detailed results.

diagnose debug application sslvpn -1
diagnose debug enable

The CLI displays debug output similar to the following:

FGT60C3G10002814 # [282:root]SSL state:before/accept initialization (172.20.120.12)
[282:root]SSL state:SSLv3 read client hello A (172.20.120.12)
[282:root]SSL state:SSLv3 write server hello A (172.20.120.12)
[282:root]SSL state:SSLv3 write change cipher spec A (172.20.120.12)
[282:root]SSL state:SSLv3 write finished B (172.20.120.12)
[282:root]SSL state:SSLv3 flush data (172.20.120.12)
[282:root]SSL state:SSLv3 read finished A:system lib(172.20.120.12)
[282:root]SSL state:SSLv3 read finished A (172.20.120.12)
[282:root]SSL state:SSL negotiation finished successfully (172.20.120.12)
[282:root]SSL established: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1

To disable the debug:

diagnose debug disable
diagnose debug reset

Remote user authentication debug command

Use the following diagnose commands to identify remote user authentication issues.

diagnose debug application fnbamd -1
diagnose debug reset

Troubleshooting common issues

To troubleshoot getting no response from the SSL VPN URL:

1. Go to VPN > SSL-VPN Settings.
   1. Check the SSL VPN port assignment.
   2. Check the Restrict Access setting to ensure the host you are connecting from is allowed.
2. Go to Policy > IPv4 Policy or Policy > IPv6 policy.
   1. Check that the policy for SSL VPN traffic is configured correctly.
   2. Check the URL you are attempting to connect to. It should follow this pattern:

      https://<FortiGate IP>:<Port>

   3. Check that you are using the correct port number in the URL. Ensure FortiGate is reachable from the computer.

      ping <FortiGate IP>

   4. Check the browser has TLS 1.1, TLS 1.2, and TLS 1.3 enabled.

To troubleshoot FortiGate connection issues:

1. Check the Release Notes to ensure that the FortiClient version is compatible with your version of FortiOS.
2. FortiClient uses IE security setting, In IE Internet options > Advanced > Security, check that Use TLS 1.1 and Use TLS 1.2 are enabled.
3. Check that SSL VPN ip-pools has free IPs to sign out. The default ip-pools SSLVPN_TUNNEL_ADDR1 has 10 IP addresses.
4. Export and check FortiClient debug logs.
   1. Go to File > Settings.
   2. In the Logging section, enable Export logs.
   3. Set the Log Level to Debug and select Clear logs.
   4. Try to connect to the VPN.
   5. When you get a connection error, select Export logs.

To troubleshoot SSL VPN hanging or disconnecting at 98%:

1. A new SSL VPN driver was added to FortiClient 5.6.0 and later to resolve SSL VPN connection issues. If your FortiOS version is compatible, upgrade to use one of these versions.
2. Latency or poor network connectivity can cause the login timeout on the FortiGate. In FortiOS 5.6.0 and later, use the following commands to allow a user to increase the SSL VPN login timeout setting.

   config vpn ssl settings
     set login-timeout 180 (default is 30)
     set dtls-hello-timeout 60 (default is 10)
   end

To troubleshoot tunnel mode connections shutting down after a few seconds:

This might occur if there are multiple interfaces connected to the Internet, for example, SD-WAN. This can cause the session to become “dirty”. To allow multiple interfaces to connect, use the following CLI commands.

If you are using a FortiOS 6.0.1 or later:

config system interface
  edit <name>
    set preserve-session-route enable
  next
end

If you are using a FortiOS 6.0.0 or earlier:

config vpn ssl settings
   set route-source-interface enable
end

To troubleshoot users being assigned to the wrong IP range:

1. Go to VPN > SSL-VPN Portals and VPN > SSL-VPN Settings and ensure the same IP Pool is used in both places.

   Using the same IP Pool prevents conflicts. If there is a conflict, the portal settings are used.

To troubleshoot slow SSL VPN throughput:

Many factors can contribute to slow throughput.

This recommendation tries to improve throughput by using the FortiOS Datagram Transport Layer Security (DTLS) tunnel option, available in FortiOS 5.4 and above.

DTLS allows SSL VPN to encrypt traffic using TLS and uses UDP as the transport layer instead of TCP. This avoids retransmission problems that can occur with TCP-in-TCP.

FortiClient 5.4.0 to 5.4.3 uses DTLS by default. FortiClient 5.4.4 and later uses normal TLS, regardless of the DTLS setting on the FortiGate.

To use DTLS with FortiClient:

1. Go to File > Settings and enable Preferred DTLS Tunnel.

To enable DTLS tunnel on FortiGate, use the following CLI commands:

config vpn ssl settings
  set dtls-tunnel enable
end