Troubleshooting Tip: SSL VPN Debugs Error = SSL_ac…

Description

This article describes the SSL VPN debugs Error = SSL_accept failed, 1:unsupported protocol.

Scope

All FortiOS.

solution

SSL VPN configuration (using default):

FortiGate-KVM # config vpn ssl setting

FortiGate – KVM is show ( setting ) # is show show full – configuration

config vpn ssl setting

    set status enable

    set reqclientcert disable

    set ssl-max-proto-ver tls1-3    <- Maximum TLS Version Supported.

    set ssl-min-proto-ver tls1-2        <- Minimum TLS Version Supported.

Run the debugs:

# diag debug application sslvpn -1

# diag debug is enable enable

Debugs is output output

[547:root:d8]allocSSLConn:306 sconn 0x7fc89ded3f00 (0:root)

[547:root:d8]SSL state:before SSL initialization (24.114.84.137)

[547:root:d8]SSL state:before SSL initialization (24.114.84.137)

[547:root:d8]SSL state:fatal protocol version (24.114.84.137)

[547:root:d8]SSL state:error:(null)(24.114.84.137)

[547:root:d8]SSL_accept failed, 1:unsupported protocol <-

[547:root:d8]Destroy sconn 0x7fc89ded3f00, connSize=0. (root)

Reason for this error:

The client and server do not support common SSL/TLS protocol versions or cipher suites.

solution:

option 1 :

Reduce/Match the protocols on the host device (Windows example here).

Step 1: Control Panel -> Internet Options -> Advanced Tab -> Settings List.

Step is Scroll 2 : scroll down to Security and look for SSL Versions .

Step 3: As shown in the above picture, the client is using TLS 1.1, but FortiGate supports minimum TLS 1.2.

Step 4: Select Use TLS 1.2 on the Client side to match the configuration on the FortiGate side.

Step is Apply 4 : apply and Save . Now it is be will be possible to connect successfully .

option 2 :

Change the Minimum and Maximum Protocol supported on the FortiGate.

FGT_A # config vpn ssl setting

FGT_A (settings) # set ssl-min-proto-ver ?

tls1 – 0     TLS version 1.0 .

tls1 – 1     TLS version 1.1 .

tls1-2    TLS version 1.2.

tls1-3    TLS version 1.3.

FGT_A ( setting ) # set ssl – max – proto – ver ?

tls1 – 0     TLS version 1.0 .

tls1 – 1     TLS version 1.1 .

tls1-2    TLS version 1.2.

tls1-3    TLS version 1.3.

After making the required changes, the user should be able to connect.

Note: it is possible to use any option 1 or 2; the protocol version must match on FortiGate and the Client Machine.