FortiGate SSL VPN Troubleshooting Guide

1. Verify SSL VPN service is up

diagnose vpn ssl statistics
diagnose vpn ssl list
get vpn ssl monitor

Confirm current tunnel/web users, max users, and that the daemon is running.

2. Check listening interface and port conflicts

show vpn ssl settings

Make sure source-interface is the WAN, port (default 443) does not collide with admin HTTPS access, and servercert points to a valid, non-expired certificate. Move admin GUI to a different port if needed:

config system global
  set admin-sport 8443
end

3. Firewall policy for SSL VPN

A policy from ssl.root interface to the internal LAN with the SSL VPN user group as source is mandatory. Missing this policy is the #1 cause of "authenticated but no access":

config firewall policy
  edit 0
    set name "SSLVPN_to_LAN"
    set srcintf "ssl.root"
    set dstintf "internal"
    set srcaddr "SSLVPN_TUNNEL_ADDR1"
    set dstaddr "all"
    set action accept
    set schedule "always"
    set service "ALL"
    set groups "SSLVPN_USERS"
    set nat enable
  next
end

4. Authentication failure (-455 / -5029)

Enable authentication debug:

diagnose debug reset
diagnose debug application sslvpn -1
diagnose debug application fnbamd -1
diagnose debug enable

Reproduce the login. Look for Group matched: and authenticate result. For LDAP, test the binding directly:

diagnose test authserver ldap <server-name> <user> <password>

For RADIUS:

diagnose test authserver radius <server-name> <auth-scheme> <user> <password>

Common fixes: wrong dn, missing member-attr, group filter not matching, LDAPS certificate untrusted, wrong shared secret.

5. Tunnel drops every few minutes

Usually MTU/MSS or idle timeout. Check:

show vpn ssl settings | grep -e idle-timeout -e login-timeout -e auth-timeout

Raise idle-timeout (default 300s) and enable DPD on FortiClient. For MTU, lower it on the tunnel adapter (default 1500 → 1400) and enable TCP MSS clamping on the outgoing policy:

config firewall policy
  edit <policy-id>
    set tcp-mss-sender 1350
    set tcp-mss-receiver 1350
  next
end

6. IP pool exhaustion / same-subnet collision

Ensure the SSL VPN address range does not overlap with internal networks or with client home LANs:

config firewall address
  edit "SSLVPN_TUNNEL_ADDR1"
    set type iprange
    set start-ip 10.212.134.200
    set end-ip 10.212.134.210
  next
end

Count active leases with diagnose vpn ssl list — bump the pool if you are close to the limit.

7. DNS not working inside the tunnel

config vpn ssl settings
  set dns-server1 10.10.10.5
  set dns-suffix corp.local
end

With split-tunnel, push a routing address that covers the DNS server, or disable split-tunnel for full-tunnel setups.

8. Certificate errors on FortiClient

Replace the default Fortinet_Factory certificate with a public CA cert (Let's Encrypt or commercial) bound to your FQDN. Import via System > Certificates, then:

config vpn ssl settings
  set servercert "public-cert"
end

9. Slow throughput

• Verify SSL cipher: set banned-cipher LOW MEDIUM and prefer ECDHE-RSA-AES256-GCM-SHA384.
• Enable dtls-tunnel (UDP) for higher throughput: set dtls-tunnel enable.
• Check CPU: diagnose sys top 5 — sustained sslvpnd at 90%+ means the box is undersized.

10. Real-time packet capture

diagnose sniffer packet any "host <client-public-ip> and port 443" 4 0 l

Combine with the sslvpn debug from step 4 to correlate handshake failures with policy hits.

After each change:

1. diagnose vpn ssl list shows the user with the expected virtual IP.
2. From the client, ping an internal host and nslookup an internal FQDN.
3. Session table confirms traffic: diagnose sys session filter src <vpn-ip> then diagnose sys session list.
4. execute log filter category 1 + execute log display shows an action=accept policy hit for the tunnel traffic.
5. Re-run the sslvpn debug and confirm no denied or auth failed lines during a fresh connection.