medium

Collecting FortiClient and FortiGate Logs for VPN Connection Troubleshooting

Confirmed 8/8/2026

Problem

VPN connection failures require synchronized FortiClient diagnostics, configuration backups, FortiGate configuration, and CLI debug output for effective technical support analysis. Collect the data while reproducing the issue and record the endpoint's local time so events can be correlated.

Symptoms

FortiClient cannot establish an IPsec or SSL VPN tunnel, including failures involving SAML, RADIUS, or LDAP authentication.

Environment

FortiClient, FortiClient EMS, FortiGate, IPsec VPN, and SSL VPN. FortiClient EMS 7.4.6 and later hides SSL VPN from Endpoint Profiles by default. In FortiClient 8.0.0 and later, the Diagnostic Tool is located on the Settings tab. Windows, macOS, and Linux endpoints are covered.

Solution

Enable FortiClient debug logging.

In FortiClient EMS, open the System Settings profile assigned to the affected endpoint:

Endpoint Profiles -> System Settings -> Select the profile -> Advanced -> Log Level -> Debug

On the endpoint, use the FortiClient Settings tab to confirm that the updated profile was received and the log level changed to Debug.
Back up the FortiClient configuration.

Export the configuration from the FortiClient Settings tab. If Backup is unavailable, disable Do not allow user to back up configuration in the applicable System Settings endpoint profile in FortiClient EMS.
Back up the FortiGate configuration.

Retrieve the FortiGate configuration backup for review before troubleshooting the connection.
Start FortiGate CLI diagnostics before initiating the VPN connection.

For an IPsec VPN, replace X.X.X.X with the remote IPv4 address and run:

diagnose debug reset diagnose debug console timestamp enable diagnose vpn ike log filter rem-addr4 X.X.X.X diagnose debug app ike -1 diagnose debug enable


   The default IKE debug records for 30 minutes. If a longer capture is required, use the procedure in [Technical Tip: Changing debug duration](https://community.fortinet.com/t5/FortiGate/Technical-Tip-Changing-debug-duration/ta-p/191069).

   For SSL VPN, replace `X.X.X.X` with the source IPv4 address and run:

diagnose debug reset diagnose debug console timestamp enable diagnose vpn ssl debug-filter src-addr4 X.X.X.X. diagnose debug app sslvpn -1 diagnose debug enable


   Starting with FortiClient EMS 7.4.6, SSL VPN is hidden from Endpoint Profiles by default, and migration to IPsec is strongly recommended. See [SSL VPN feature select option is hidden by default 7.4.6](https://docs.fortinet.com/document/forticlient/7.4.0/new-features/483736/ssl-vpn-feature-select-option-is-hidden-by-default-7-4-6) and [SSL VPN to IPsec VPN Migration](https://docs.fortinet.com/document/fortigate/7.6.0/ssl-vpn-to-ipsec-vpn-migration/126460/introduction).

   If authentication uses RADIUS or LDAP, add:

diagnose debug app fnbamd -1


   If authentication uses SAML, add:

diagnose debug app samld -1


5. **Reproduce the problem.**

   Attempt to connect to the VPN tunnel while the FortiGate debug is running. Record the endpoint's local time at the moment of the failed or unexpected connection attempt.

6. **Stop and save the FortiGate debug output.**

   After the event has been captured, save the CLI output and stop debugging with:

diagnose debug reset diagnose debug disable


7. **Collect FortiClient diagnostics.**

   - Windows before FortiClient 8.0.0: **FortiClient console -> About -> Diagnostics Tool**.
   - Windows with FortiClient 8.0.0 or later: use the Diagnostic Tool on the **Settings** tab.
   - macOS and Linux: **FortiClient console -> Settings -> Export Logs**.

   VPN logs may also be present at these Windows paths:

   - `C:\Program Files\Fortinet\FortiClient\logs race.`
   - `C:\Users\%USER%\AppData\Roaming\FortiClient\logs race.`

8. **Restore the normal FortiClient log level.**

   After collection is complete, change the assigned EMS profile back to **Info**:

   **EMS -> Endpoint Profiles -> System Settings -> Select the profile -> Advanced -> Log Level -> Info**

9. **Submit the collected evidence.**

   Open a ticket at [Fortinet Support](https://support.fortinet.com/) and attach the FortiClient configuration backup, FortiClient diagnostics or exported logs, FortiGate configuration backup, FortiGate CLI output, and the recorded endpoint local time.

10. **Collect additional output for IPsec SAML failures when applicable.**

    If IPsec SAML authentication fails, also collect the FortiGate `execute tac report` CLI output. Refer to [Troubleshooting Tip: IPsec SAML Authentication fails due to fnbamd daemon crash](https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-SAML-Authentication-fails-due-to/ta-p/339738) for additional details.

Verification

Confirm that the FortiClient endpoint received the EMS profile and shows Debug logging before reproduction. After reproducing the issue, verify that FortiGate CLI output contains timestamped events corresponding to the recorded endpoint local time and that the FortiClient diagnostic package or exported logs were created successfully.

Rollback

Stop FortiGate debugging with diagnose debug reset followed by diagnose debug disable. Then restore the FortiClient EMS log level to Info at EMS -> Endpoint Profiles -> System Settings -> Select the profile -> Advanced -> Log Level -> Info.

Community rating

— / 5 (0)

Discussion (0)

No comments yet.