Troubleshooting SSL VPN connections with FortiGate diagnostic commands

1. Review basic SSL VPN information by running the command with the appropriate parameter:

diagnose vpn ssl [list/info/statistics/debug-filter/hw-acceleration-status]

Parameter functions:

• list: Displays current connections.
• info: Displays general SSL VPN information.
• statistics: Displays memory usage and concurrent and maximum connection counts.
• hw-acceleration-status: Displays hardware acceleration status.

2. On FortiOS 7.2 and later, use the following command instead of hw-acceleration-status:

diagnose vpn ssl blocklist

This displays users blocked after exceeding the login-attempt-limit.

3. To limit SSL VPN debug output to a specific client, replace x.x.x.x with that client's public IP address:

diagnose vpn ssl debug-filter src-addr4 x.x.x.x

4. Enable the required application debugs. Use only the debugs relevant to the issue, or enable all of them when a full trace is required:

diagnose debug application sslvpn -1

This displays SSL VPN connection messages.

diagnose debug application tvc -1

This displays SSL VPN client daemon messages.

diagnose debug application fnbamd -1

This displays the authentication process.

diagnose debug application authd -1

This displays authenticated users.

5. If the SSL VPN uses SAML authentication, also enable the SAML daemon debug:

diagnose debug application samld -1

6. Start debug output:

diagnose debug enable

7. Reproduce the SSL VPN problem and collect the resulting messages.

8. Stop debugging after the test:

diagnose debug disable

Confirm that the selected status command returns the expected SSL VPN information. During reproduction, verify that debug output contains the relevant connection, client daemon, authentication, authenticated-user, or SAML messages. Always stop the debug with diagnose debug disable after collecting the trace.