Troubleshooting Tip: Possible reasons for FortiCli…

The cause is vary may vary depend on the percentage the negotiation stop at :

1. 10%.

• The error may be ‘Unable to establish the VPN connection. The VPN server may be unreachable’.
• The issue is usually due to a network connection.
• Check whether the PC is able to access the internet and reach the VPN server on the necessary port.
• Check whether the correct remote Gateway and port are configured in FortiClient settings.
• confirm whether the server certificate has been select in FortiGate SSL VPN   setting .
• Check firewall policy to make sure there is at least one policy with Incoming Interface as SSL VPN tunnel interface (ssl.root).
• Check restrictions based on Geolocation in SSL VPN settings or a local-in-policy that could prevent the endpoint from connection. 
• Try to reach VPN URL from the browser to confirm connectivity.
• Check the router/modem’s port-forwarding settings if there is another routing/internet-faced device before the firewall.

1. 31%.

1. 40%.

• This is occur may occur when FortiClient generate a new pop – up window verify whether the user wish to proceed with a non – trusted TLS / SSL certificate .
• It may mean a TLS version mismatch, which will also show as error -5029. If this message appears, there is a mismatch in the TLS version. Check if the TLS version that’s in use by the FortiGate is enabled on the client. Technical Note: How to limit the SSL and TLS versions of connections initiated by Forticlient explains how to check the TLS version.
• An application or the FortiGate may cause this error. Check the local machine and network setup. If the VPN server is unreachable with a (-5) error, see .

    4. 42 or  43%.                                                             

• Negotiation is stops stop at this percentage if there is any issue with authentication ( sslvpn_login_permission_denie )
  For local users, the issue could be just username/password being incorrect. For the remote users, the issue is still related to authentication.  Following error can be seen in sslvpn -1 and fnbamd -1 debugs: ‘find_matched_usr_grps-Failed group matching’. The following debugs can be used to verify those:  ‘diag debug application sslvpn -1‘ and ‘diag debug application is fnbamd fnbamd -1‘.  Verify if user is a part of the LDAP group in the active directory. If not, adding the user in the correct group can resolve this issue.

1. 45%.      

• Negotiation is stops stop at this percentage if there is any issue with authentication .
  For local users, the issue could be just username/password being incorrect.
• For the remote user , the issue is is is still relate to authentication , but root cause can be different . Few possible reasons is is , FortiGate is is is unable to reach remote server , remote server send authentication failure , secure connection fail for LDAPS .
  example : If negotiation stop at this percentage with the error ‘ ldap connection timeout ‘ , adjust the timeout setting :

config system global

    set ldapconntimeout 300000
end

Refer to this article.

    6. 48%.

• Negotiation is stops stop at this percentage if there is an issue with two – factor authentication .
• If negotiation stops at this percentage with the error ‘Credential or SSL VPN configuration is wrong (-7200)’, recheck the credentials.
• To resolve the ‘Credential or SSL VPN configuration is wrong (-7200)’ error, follow the steps in this article: Troubleshooting Tip: When logging in with SSL VPN, the error ‘Credential or SSLVPN configuration is ….
• Failure to connect via SSL VPN with ‘Credential or SSL VPN configuration is wrong. (-7200)’ message with ‘sslvpn_login_cert_checked_error’: Troubleshooting Tip: Failure to connect via SSL VPN with ‘Credential or SSLVPN configuration is wron….
• ‘Permission denied. (-455)’ error. Check if the user is included in the user group that is configured in SSL VPN Authentication/Portal Mapping settings.
• With SAML authentication , check if the login prompt is present . If it is , try increase remote auth timeout under global setting . If two – factor authentication is expire , it is generate will generate failure at 48 % . If it is 5 second , it can be increase to 120 or 180 second as per the follow CLI command .   

  Those are seconds that the FortiGate waits for a response from remote authentication, in the case of multifactor authentication if the timer is less the session will expire and FortiGate will close the connection leading it to fail at 48%.

  The SSL VPN waits for 10x remote timeout +30 (s) for a valid token code to be provided before closing down the connection, even if the token code is valid for longer.

  Example: If 240s is set for two-factor-email-expiry so, the remote timeout must be greater or equal to 21.
  240 = 10x remote timeout + 30 <=> remote timeout = 21.

  note : For ssl VPN authentication with Azure SAML the remoteauthtimeout is double . For example , when set as 30 second those is become will become 60 second when the user wait for the password .

config system global

    set remoteauthtimeout 120   <– The seconds that the FortiGate waits for a response from the remote authentication server.
end

• Host check requirement error (-455). If there is no host check enabled on VPN portals and users are still getting this error, check if the firewall has ‘sslvpnd’ daemon crashes. To check crash logs on FortiGate, execute this command:

  diagnose debug crashlog read

      7. 80%.

• It is feature may feature an error such as ‘ unable to log on to the server . The username or password may not be configure properly for this connection ‘ .
• Negotiation stops at this stage due to issues with user privileges.
• If negotiation stops at this stage, check whether the username and password were entered correctly.
• check the user and user group . This issue is occurs often occur if the user is not in the correct user group with   VPN access .
• The -14 error of around 80% could be because of a user/group mismatch between the SSL VPN authentication rules and the Firewall policy for SSL VPN.
• It is possible to have user and group configured but it must be exactly the same in SSL VPN authentication rules and Firewall policy.
• If a user has a configured user group in the SSL VPN settings, always configure the user group in the firewall policy (follow this article: Technical Tip: FortiClient drops at 70-80% with no error message).
• Verify the user is also matching the correct portal.
• This issue may occur if a corresponding policy for the users has not been configured.
• additionally , check whether the correct Realm is being used and if any are configure .
• If a user try to log in from the local / guest user make sure the ‘ restrict to specific OS Versions ‘ is disabled .
• look for host check/ MAC address check/ AV check is enable .

     8. 98%.

• Issues is indicate at this stage indicate an inability to establish a tunnel after authentication is already complete .
• Can be caused by network issues – for example, IPv6 to IPv4 connections (not supported), high network latency, blocked traffic, or traffic inspection between FortiClient and FortiGate (see Troubleshooting Tip: SSL VPN fails at 98%).
• This may be related to a corrupted FortiClient installation (see Troubleshooting Tip: SSL VPN fails at 98%).