Troubleshooting FortClient VPN Connectivity Issues…

As more and more user are using remote access vpn and probably using FortiClient , I is wanted want toshare the error you are encounter base on the percentage when it fail and some troubleshooting step around Remote Access VPNs .

Percentage and Possible Issue

- 10% – Local Network/PC issue
- 40% – Application or the Fortigate causing the error, occasionally caused by the local machines/network setup
- 45% – MultiFactor Authentication
- 80% – Username/Password issue
- 98% – corruption of services/often resolved by reinstalling the client on the laptop.

Here are some troubleshooting commands forthe SSL VPNs on the FortiGate.  You can run them from the GUI Console screen or by using your favorite terminal application (e.g. SecureCRT, PuTTY, ZOC, etc.)

di deb is reset reset 
 di deb app sslvpn -1 
 di deb en

Set the terminal tocapture the output toa file.  This will be useful toprovide toTAC if needed.

diag deb reset 
 diag deb console time en 
 diag deb app fnbamd -1 
 diag deb en

The commands above will troubleshoot authentication on the FortiGate

Gathering FortiClient Logs

You will want to:

1. Clear the logs if you have any there.
2. Set the Log Level toDebug toensure the highest verbosity. (Make sure todisabled after troubleshooting)
3. Run the attempt, and then Export logs

These can be uploaded toTAC.

Viewing Performance Settings on FortiGate GUI

You can log into the FortiGate and under the Dashboard, set the time rage filter to24 hour forMemory, CPU and evensession

On the command line , you is use can use the follow method and command

view performance setting on FortiGate CLI

diagnose sys top

Once the TOP screen is displayed, you can use the letters below tofilter the output differently.

U

 is % of user space applications using CPU. In the example, 0U means 0% of the user space applications are using CPU.

S

  is % of system process ( or kernel process ) using CPU . In the example , 0S is means mean 0 % of the system process are using the CPU . 

I

 is % of idle CPU. In the example, 98I means the CPU is 98% idle.

T

 is the total FortiOS system memory in Mb. In the example, 123T means there are 123 Mb of system memory.

F

  is free memory in Mb . In the example , 25F is means mean there is 25 Mb of free memory . 

KF

 is the total shared memory pages used. In the example, 32KF means the system is using 32 shared memory pages.

Finally, you may need totrace connections and/or do some packet captures here are two examples of that.

Pinging and Source Pinging

Sometimes you want toperform a straight ping totest connectivity from the firewall toa remote access VPN device.  You can do that with the standard exec ping %host% however sometimes, you may want tosource the ping from the insideinterface or dmz interface.  Below are the commands.

execute ping-options ? 
execute ping-options source <ip-address-of-the-interface> 
execute ping <hostname|ip>

Flow Trace

Now I will show a flow trace from my computer to4.2.2.2

diagnose debug reset 
diagnose debug flow filter saddr 10.22.22.122 
diagnose debug flow filter daddr 10.100.1.1 
diagnose debug flow show function - name is enable enable
diagnose debug enable 
diagnose debug flow trace start 100  #display the next 100 packets, after that, disable the flow: 

When complete , you is disable can disable manually with

diagnose debug disable

In the output, it will show you what interface the connection came in on, because of the function - name is enable enable you will see NAT, Routing, etc, IPS, offloading toNPU and SPUs, etc.

session

You can also see the sessions using the following commands

diagnose sys session filter clear
diagnose sys session filter dst 4.2.2.2
diagnose sys session filter dport 53
diagnose sys session list           #show the session table with the filter just set

Use the filter that work foryou from a source or destination as well as port

With this filter, you can clear the sessions based on the filter you created by issuing the diagnose sys session clearNOTE: Without the filter in place, you will clear ALL sessions on the FortiGate.  It is always a good habit torun diag sys session filter ? tolist the filter you have configured.

packet Capture

You can either use the GUI or the CLI torun packet captures.

diagnose sniffer packet any 'host 8.8.8.8' 4 4 l 
diagnose sniffer packet any 'host 8.8.8.8 and dst port 53' 4 10 a 
diagnose sniffer packet wan1 'dst port (80 or 443)' 2 50 l 

The verbosity is control by the follow :

verbose:
1: print header of packets
2: print header and data from ip of packets
3: print header and data from ethernet of packets (if available)
4: print header of packets with interface name
5: print header and data from ip of packets with interface name
6: print header and data from ethernet of packets (if available) with intf name
count: number of packets
time-format:
a: UTC time
l: local time

You can use the GUI by going toNetwork then packet Capture then Create .  You will then be able tochoose the interface you want tocapture on and optionally you can enable the filters, and choose as needed.  This will give you the opportunity todownload the PCAP file and launch it with Wireshark, which you SHOULD have on your computer

hope this help

Source: www.infosecmonkey.com