fortigate - ssl-vpn cheat sheet

fortigate - ssl-vpn cheat sheet

#====================================================================================================================================
# microsoft built-in vpn client on windows 11 , not working
only for "local" user account, no fortinet support on ms store

#====================================================================================================================================
# microsoft built-in vpn client on windows 11 , not working
# ChatGPT

let's explore examples to illustrate the differences between L2TP/IPsec and SSL VPN in practical scenarios:

Scenario 1: Remote Access to Corporate Network

L2TP/IPsec Example:
A company needs its remote employees to securely access various resources on the corporate network, including file shares, databases, and internal applications. They set up an L2TP/IPsec VPN with certificate-based authentication. Employees install VPN client software on their devices, configure certificates, and connect to the corporate network. This solution allows employees to have network-level access to all resources.

SSL VPN Example:
Another company opts for SSL VPN to provide remote access. Their remote employees need to access web-based applications, email, and some internal tools. Instead of installing a dedicated VPN client, employees simply open a web browser and log in to the SSL VPN portal. They can access web applications directly through the browser, making it easy to collaborate and work remotely.

Scenario 2: Client-to-Site VPN for External Contractors

L2TP/IPsec Example:
An organization works with external contractors who need to access specific servers on the internal network. They configure an L2TP/IPsec VPN with pre-shared key authentication. Contractors set up their devices with the pre-shared key and gain access to the servers for project collaboration. The company maintains network-level control and ensures secure communication.

SSL VPN Example:
Another organization uses SSL VPN to grant remote access to external contractors. The contractors need to access a web-based project management tool and a shared document repository. The organization provides contractors with SSL VPN credentials, and contractors can access the required tools via their web browsers without installing additional software.

Scenario 3: Secure Remote Desktop Access

L2TP/IPsec Example:
A company requires remote employees to access their workstations remotely. They set up an L2TP/IPsec VPN with certificate-based authentication. Remote employees establish secure connections to their workstations using remote desktop software. This approach provides network-level access and allows employees to interact with their computers as if they were physically present in the office.

SSL VPN Example:
A different company uses SSL VPN for remote desktop access. Remote employees can log in to an SSL VPN portal, where they find a secure remote desktop gateway. They launch remote desktop sessions from their browsers, accessing their workstations without the need for separate remote desktop software.

In summary, L2TP/IPsec is suitable for scenarios requiring network-level access, strong security, and certificate-based authentication. SSL VPN is preferable when ease of use, web-based access, and compatibility across devices are important. The choice between these VPN types depends on the specific needs of your organization and the resources your users need to access remotely.

#====================================================================================================================================
# microsoft built-in vpn client on windows 11 , not working
# ChatGPT

 a bit more context to clarify the capabilities of both L2TP/IPsec and SSL VPNs in terms of tunneling traffic.

L2TP/IPsec:

L2TP/IPsec can indeed be used to tunnel all traffic or only specific traffic, offering flexibility in how you route your network traffic:

Tunnel All Traffic: When you configure an L2TP/IPsec connection as the default route on a client device, all of the device's network traffic is encrypted and routed through the VPN tunnel to the remote network. This effectively routes all internet traffic through the VPN connection.

Split Tunneling: Alternatively, with proper configuration, you can set up "split tunneling" with L2TP/IPsec. This means that only specific traffic destined for the remote network goes through the VPN tunnel, while all other traffic directly accesses the internet. Split tunneling can help reduce bandwidth consumption and improve internet performance for the client.

SSL VPN:

SSL VPN, on the other hand, typically functions as a "full tunnel," which means that it routes all traffic through the SSL VPN connection:

Tunnel All Traffic: In most SSL VPN implementations, all traffic from the client's device is encrypted and routed through the SSL VPN tunnel. This includes both traffic destined for the remote network and traffic destined for the internet. As a result, the remote network can filter and control all of the client's traffic.
While SSL VPNs are commonly designed for full tunneling, some SSL VPN solutions do offer options for split tunneling or allowing access to specific resources while still routing other traffic directly to the internet. However, these capabilities can vary based on the SSL VPN solution you are using and the configuration options available.

In summary, L2TP/IPsec offers more flexibility in terms of tunneling options, allowing for both full tunneling and split tunneling. SSL VPNs, while typically designed for full tunneling, might provide limited options for controlling traffic routing depending on the specific SSL VPN solution. Always refer to the documentation of your chosen VPN technology and solution for accurate details about its capabilities.

#====================================================================================================================================
# microsoft built-in vpn client on windows 11 , not working
# Bard

 L2TP/IPsec is generally considered to be more secure than SSL VPN because it operates at two different layers of the OSI model: Layer 2 (Data Link Layer) and Layer 3 (Network Layer).

L2TP operates at Layer 2, which is responsible for the physical transmission of data between two devices. L2TP encrypts the data at this layer, which makes it difficult for attackers to intercept or decrypt the data.
IPsec operates at Layer 3, which is responsible for routing data between devices on a network. IPsec encrypts the data at this layer, which further protects the data from attackers.
SSL VPN, on the other hand, only operates at Layer 7 (Application Layer). SSL encrypts the data at this layer, which is still a very secure way to transmit data. However, it is not as secure as L2TP/IPsec because it only encrypts the data at one layer.

In addition, L2TP/IPsec can be used to tunnel all traffic, or only specific traffic. This gives you more control over the data that is being encrypted. SSL VPN can only be used to tunnel all traffic.

Finally, L2TP/IPsec is supported by a wider range of devices and operating systems than SSL VPN. This means that you are more likely to be able to use L2TP/IPsec with your existing devices and operating systems.

Overall, L2TP/IPsec is a more secure and versatile VPN protocol than SSL VPN. However, SSL VPN is easier to set up and use, and it is more widely supported by VPN providers.

Here is a table that summarizes the security of L2TP/IPsec and SSL VPN over the OSI model:
#====================================================================================================================================
# microsoft built-in vpn client on windows 11 , not working
# Bard

. L2TP/IPsec is generally considered to be more secure than SSL VPN because it uses two layers of encryption: L2TP and IPsec. L2TP encrypts the data at the packet level, and IPsec encrypts the data at the network layer. This makes it very difficult for attackers to intercept or decrypt the data that is being transmitted over the VPN.

SSL VPN, on the other hand, only uses one layer of encryption: SSL. SSL encrypts the data at the application layer. This is still a very secure way to transmit data, but it is not as secure as L2TP/IPsec.

In addition, L2TP/IPsec can be used to tunnel all traffic, or only specific traffic. This gives you more control over the data that is being encrypted. SSL VPN can only be used to tunnel all traffic.

Finally, L2TP/IPsec is supported by a wider range of devices and operating systems than SSL VPN. This means that you are more likely to be able to use L2TP/IPsec with your existing devices and operating systems.

Overall, L2TP/IPsec is a more secure and versatile VPN protocol than SSL VPN. However, SSL VPN is easier to set up and use, and it is more widely supported by VPN providers.
#====================================================================================================================================
# microsoft built-in vpn client on windows 11 , not working
# ChatGPT

Comparing L2TP/IPsec and SSL VPN involves evaluating their pros and cons based on factors like security, compatibility, ease of use, and specific use cases. Here's a comparison of the two VPN types:

L2TP/IPsec (Layer 2 Tunneling Protocol over IPsec):

Pros:

Strong Security: L2TP provides tunneling, while IPsec provides encryption, authentication, and data integrity. When configured properly, it offers robust security.
Certificate-Based Authentication: Can use certificates for client and server authentication, enhancing security and mutual trust.
Compatibility: L2TP/IPsec is natively supported on many devices, including Windows, macOS, iOS, and Android.
Network-Level Access: Can provide network-level access to resources beyond just web applications, making it suitable for a wide range of services.
Centralized Management: L2TP/IPsec VPNs can be centrally managed using authentication servers like RADIUS.
Cons:

Configuration Complexity: Setting up L2TP/IPsec correctly requires configuring both L2TP and IPsec settings, which can be complex for non-technical users.
Potential Compatibility Issues: Some networks might block L2TP/IPsec due to the use of non-standard ports.
SSL VPN (Secure Sockets Layer VPN):

Pros:

Ease of Use: SSL VPN provides remote access via web browsers, eliminating the need for dedicated client software. Users can access resources without complex configurations.
High Compatibility: Works on a wide range of devices and operating systems that support web browsing.
Granular Access Control: SSL VPN can offer more granular access controls, allowing you to restrict access to specific applications or resources.
Less Prone to Firewall Blocks: Since it uses standard HTTPS ports (443), SSL VPN is less likely to be blocked by firewalls.
Remote Desktop Access: Some SSL VPN solutions offer the ability to access remote desktops directly through the browser.
Cons:

Web Application Limitation: SSL VPN is best suited for accessing web-based applications and resources. It might not provide network-level access to all types of resources.
Limited Network-Level Control: SSL VPN might lack the flexibility for certain advanced networking scenarios compared to L2TP/IPsec.
Choosing Between L2TP/IPsec and SSL VPN:

Choose L2TP/IPsec If: You need network-level access to a broader range of resources, have the expertise to configure it securely, and prioritize strong security through certificate-based authentication.

Choose SSL VPN If: You prioritize ease of use, require remote access to web applications and resources, and need compatibility across various devices without complex client installations.

Ultimately, the choice depends on your organization's security needs, the types of resources users need to access, and the level of technical expertise available for configuration and maintenance. For high-security environments, L2TP/IPsec might be preferred, while SSL VPN offers a user-friendly remote access solution for various use cases.
#====================================================================================================================================
# microsoft built-in vpn client on windows 11 , not working
#Bard

 L2TP/IPsec is generally considered to be more secure than SSL VPN because it uses two layers of encryption: L2TP and IPsec. L2TP encrypts the data at the packet level, and IPsec encrypts the data at the network layer. This makes it very difficult for attackers to intercept or decrypt the data that is being transmitted over the VPN.

SSL VPN, on the other hand, only uses one layer of encryption: SSL. SSL encrypts the data at the application layer. This is still a very secure way to transmit data, but it is not as secure as L2TP/IPsec.

In addition, L2TP/IPsec can be used to tunnel all traffic, or only specific traffic. This gives you more control over the data that is being encrypted. SSL VPN can only be used to tunnel all traffic.

Finally, L2TP/IPsec is supported by a wider range of devices and operating systems than SSL VPN. This means that you are more likely to be able to use L2TP/IPsec with your existing devices and operating systems.

Overall, L2TP/IPsec is a more secure and versatile VPN protocol than SSL VPN. However, SSL VPN is easier to set up and use, and it is more widely supported by VPN providers.

#====================================================================================================================================
# microsoft built-in vpn client on windows 11 , not working
#Bard

 here is a comparison of the pros and cons of L2TP/IPsec and SSL VPN:

VPN type	Pros	Cons
L2TP/IPsec
* Very secure
* Supports a wide range of devices and operating systems
* Relatively easy to set up and use
* Can be used to connect to remote networks and applications
* Can be used to tunnel all traffic, or only specific traffic
|
* Can be more complex to configure than SSL VPN
* May not be as widely supported by all VPN providers
* May not be as fast as SSL VPN
| SSL VPN |
* Very secure
* Supports a wide range of devices and operating systems
* Relatively easy to set up and use
* Can be used to connect to remote networks and applications
* Can be used to tunnel all traffic, or only specific traffic
|
* May not be as secure as L2TP/IPsec
* May not be as fast as L2TP/IPsec
* May not be as widely supported by all VPN providers

As you can see, both L2TP/IPsec and SSL VPN are very secure VPN protocols. However, L2TP/IPsec is generally considered to be more secure than SSL VPN. L2TP/IPsec also supports a wider range of devices and operating systems, and it is relatively easy to set up and use. However, L2TP/IPsec can be more complex to configure than SSL VPN, and it may not be as widely supported by all VPN providers. SSL VPN is generally considered to be easier to set up and use than L2TP/IPsec, and it is more widely supported by VPN providers. However, SSL VPN may not be as secure as L2TP/IPsec, and it may not be as fast.

The best VPN type for you will depend on your individual needs and preferences. If you are looking for the most secure VPN protocol, then I recommend using L2TP/IPsec. If you need an easy-to-set-up VPN protocol that is widely supported, then I recommend using SSL VPN.
#====================================================================================================================================
# microsoft built-in vpn client on windows 11 , not working
#Bard

SSTP (Secure Socket Tunneling Protocol): SSTP is a VPN protocol that uses the Secure Sockets Layer (SSL) protocol to encrypt traffic. This makes it a very secure VPN protocol. SSTP is also relatively easy to set up and use. However, SSTP is not supported by all VPN providers.
L2TP/IPsec with certificate: L2TP/IPsec is a VPN protocol that uses the Layer 2 Tunneling Protocol (L2TP) to encapsulate traffic and the Internet Protocol Security (IPsec) protocol to encrypt traffic. This makes it a very secure VPN protocol. L2TP/IPsec is also supported by most VPN providers. However, L2TP/IPsec can be more difficult to set up and use than some other VPN protocols.
L2TP/IPsec with pre-shared key: L2TP/IPsec with pre-shared key is a variation of the L2TP/IPsec protocol that uses a pre-shared key for authentication instead of a certificate. This makes it less secure than L2TP/IPsec with certificate, but it is also easier to set up and use.
PPTP (Point-to-Point Tunneling Protocol): PPTP is a legacy VPN protocol that is not as secure as some of the newer VPN protocols. However, PPTP is easy to set up and use, and it is supported by most VPN providers.
SSL VPN: SSL VPN is a VPN protocol that uses the Secure Sockets Layer (SSL) protocol to encrypt traffic. This makes it a very secure VPN protocol. SSL VPN is also relatively easy to set up and use. However, SSL VPN is not as secure as some of the other VPN protocols, such as L2TP/IPsec with certificate

Here is a table that summarizes the different VPN types:

VPN type	Security	Ease of setup	Support
SSTP	Very secure	Easy	Most providers
L2TP/IPsec with certificate	Very secure	Moderate	Most providers
L2TP/IPsec with pre-shared key	Less secure	Easy	Most providers
PPTP	Not as secure	Easy	Most providers
SSL VPN	Very secure	Easy	Most providers

here is a comparison of the different VPN types and which one is most secure to implement on a Fortigate 600E firewall:

VPN type	Security	Ease of setup	Support	Fortigate 600E support
SSTP	Very secure	Easy	Most providers	Yes
L2TP/IPsec with certificate	Very secure	Moderate	Most providers	Yes
L2TP/IPsec with pre-shared key	Less secure	Easy	Most providers	Yes
PPTP	Not as secure	Easy	Most providers	Yes
SSL VPN	Very secure	Easy	Most providers	Yes
The most secure VPN type to implement on a Fortigate 600E firewall is L2TP/IPsec with certificate. This is because it uses both L2TP and IPsec to encrypt traffic, which makes it very difficult for attackers to intercept or decrypt. L2TP/IPsec with certificate is also relatively easy to set up and use, and it is supported by most VPN providers.

The next most secure VPN type is SSTP. This is also a very secure VPN protocol, but it is not as widely supported as L2TP/IPsec with certificate.

The least secure VPN type is PPTP. PPTP is a legacy VPN protocol that is not as secure as the newer VPN protocols. However, PPTP is easy to set up and use, and it is supported by most VPN providers.

If you are looking for the most secure VPN protocol to implement on your Fortigate 600E firewall, then I recommend using L2TP/IPsec with certificate. If L2TP/IPsec with certificate is not available, then you can use SSTP. If you need an easy-to-set-up VPN protocol, then you can use PPTP or SSL VPN.

Here is a table that summarizes the security of the different VPN types:

VPN type	Security
L2TP/IPsec with certificate	Very secure
SSTP	Very secure
L2TP/IPsec with pre-shared key	Less secure
PPTP	Not as secure
SSL VPN	Very secure
As you can see, L2TP/IPsec with certificate and SSTP are the most secure VPN types. However, L2TP/IPsec with certificate is more widely supported than SSTP. If you are looking for the most secure VPN protocol that is also widely supported, then I recommend using L2TP/IPsec with certificate.

#====================================================================================================================================
# microsoft built-in vpn client on windows 11 , not working
#ChatGPT

 Here's an explanation of various VPN types:

SSTP (Secure Socket Tunneling Protocol):
SSTP is a VPN protocol developed by Microsoft. It uses the SSL/TLS protocol for encryption and is designed to establish a secure connection over HTTPS. SSTP is often used for Windows-based clients to connect to VPN servers. It's known for its ability to pass through firewalls and proxy servers since it uses the standard HTTPS port (443).

L2TP/IPsec with Certificate:
L2TP (Layer 2 Tunneling Protocol) combined with IPsec (Internet Protocol Security) provides a secure and encrypted connection. When using certificates for authentication, the client and server exchange certificates to establish trust and ensure the confidentiality and integrity of the connection.

L2TP/IPsec with Pre-Shared Key:
Similar to the previous option, L2TP/IPsec provides security and encryption for VPN connections. However, in this case, a pre-shared key (PSK) is used for authentication instead of certificates. The PSK is a shared secret known to both the client and the server, and it helps establish the connection securely.

PPTP (Point-to-Point Tunneling Protocol):
PPTP is one of the earliest VPN protocols. It's relatively simple and easy to set up. It uses GRE (Generic Routing Encapsulation) to encapsulate data packets and is known for its compatibility with older systems. However, PPTP is considered less secure than newer protocols due to vulnerabilities.

SSL VPN (Secure Sockets Layer VPN):
SSL VPN is a versatile VPN solution that operates over the HTTPS protocol. It allows remote users to securely access internal resources through a web browser, eliminating the need for specialized client software. SSL VPN provides access to web applications, file shares, and other resources using SSL encryption. It's often used for remote access and can be implemented through various methods, including clientless access and full tunneling.

Remember that the choice of VPN type depends on factors like security requirements, compatibility, ease of configuration, and the specific use case. Newer protocols like L2TP/IPsec and SSL VPNs are generally preferred due to their stronger security features. It's important to choose the right protocol based on your organization's needs and security considerations.


Let's compare the mentioned VPN types in terms of security and suitability for implementation on a FortiGate 600E firewall:

SSTP (Secure Socket Tunneling Protocol):

Security: SSTP uses SSL/TLS encryption, making it secure against most common attacks. However, it's vulnerable to SSL-specific vulnerabilities.
Suitability: Suitable for Windows-based clients due to built-in support. Can be useful when strong security and ease of use are both important.
L2TP/IPsec with Certificate:

Security: L2TP provides tunneling, and IPsec provides encryption and authentication. Using certificates enhances security by ensuring mutual trust between client and server.
Suitability: Highly secure option, especially when certificate-based authentication is used. Suitable for scenarios where strong security is a priority.
L2TP/IPsec with Pre-Shared Key:

Security: Similar to the above, L2TP provides tunneling, and IPsec offers encryption and authentication. However, pre-shared keys are considered less secure than certificates.
Suitability: While still secure, using pre-shared keys is less recommended due to the potential vulnerability of the shared secret.
PPTP (Point-to-Point Tunneling Protocol):

Security: PPTP is significantly less secure than other options. It's susceptible to various attacks and should be avoided when security is a concern.
Suitability: Not recommended due to its known vulnerabilities. Should only be used if security is not a primary consideration.
SSL VPN (Secure Sockets Layer VPN):

Security: SSL VPN provides strong security through HTTPS encryption. It's resistant to many common attacks and vulnerabilities.
Suitability: Highly suitable for remote access scenarios. Provides secure access to web applications, file shares, and other resources without requiring specialized client software.
Most Secure Option for FortiGate 600E:
Considering security and the FortiGate 600E's capabilities, both L2TP/IPsec with certificate-based authentication and SSL VPN are strong contenders.

L2TP/IPsec with Certificate:

Pros: Offers a combination of tunneling and strong encryption/authentication using certificates. Suitable for various use cases, especially when a high level of security is required.
Cons: Configuration might be more involved compared to SSL VPN.
SSL VPN:

Pros: Utilizes HTTPS encryption, providing secure access via web browsers. Suitable for remote access to web applications and resources.
Cons: Can have slightly higher overhead due to HTTPS encryption. Might require additional configuration for specific applications.
In terms of security, both L2TP/IPsec with certificates and SSL VPN are strong options. The choice depends on your specific use case, user requirements, and the type of resources you need to access. For broader compatibility and ease of use, SSL VPN might be preferred, while L2TP/IPsec with certificates provides robust security for more critical applications. Always ensure that you configure and manage your chosen VPN type correctly to maintain the desired security level.

#====================================================================================================================================
#Set the Source Address to SSLVPN_TUNNEL_ADDR1 vs Set the Source Address to "all"
# both works

https://docs.fortinet.com/document/fortigate/6.2.9/cookbook/559546/ssl-vpn-full-tunnel-for-remote-user
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/307303/ssl-vpn-split-tunnel-for-remote-user

#CLI
config firewall policy
edit 23
set uuid 7aec9426-eda6-51ed-a571-41caac700927
set srcintf "ssl.root"
set dstintf "VLAN100"
set srcaddr "SSLVPN_TUNNEL_ADDR1"
set dstaddr "VLAN100 address"
set schedule "always"
set service "ALL"
set logtraffic all
set groups "gr-ssl-vpn"
set comments " (Copy of SSLtoLAN)"
next
end

#====================================================================================================================================
#Explain SSL-VPN tunnel interface(ssl.root) in fortigate, ChatGPT

Fortinet's FortiGate firewall devices support SSL-VPN (Secure Sockets Layer Virtual Private Network) to provide 
secure remote access to network resources. The SSL-VPN tunnel interface (ssl.root) is a virtual interface that is 
automatically created by the FortiGate device when SSL-VPN is enabled.

Virtual interface: The SSL-VPN tunnel interface is a virtual interface that can be used to route traffic between the 
remote user's device and the corporate network. This allows administrators to apply security policies to SSL-VPN traffic 
just like any other network traffic.

#====================================================================================================================================
#ChatGPT

The correct statements regarding tunnel-mode SSL VPN are:

a) Split tunneling is supported.
b) It requires the installation of a VPN client.
e) An SSL VPN IP address is dynamically assigned to the client by the FortiGate unit.

Explanation:

a) Split tunneling is supported: In tunnel-mode SSL VPN, it is possible to configure split tunneling, which allows only the necessary traffic to go through the VPN tunnel and the rest of the traffic to use the regular Internet connection.

b) It requires the installation of a VPN client: To establish a tunnel-mode SSL VPN connection, a VPN client software must be installed on the user's device. The client software can be downloaded from the FortiGate unit or from the Fortinet support portal.

c) It requires the use of an Internet browser: This statement is not correct. Tunnel-mode SSL VPN does not require the use of an Internet browser, as it relies on a VPN client software.

d) It does not support traffic from third-party network applications: This statement is not correct. Tunnel-mode SSL VPN supports traffic from any network application that runs on the user's device and has access to the Internet.

e) An SSL VPN IP address is dynamically assigned to the client by the FortiGate unit: This statement is correct. In tunnel-mode SSL VPN, the FortiGate unit assigns a virtual IP address to the client, which is used to establish the VPN tunnel and access the internal network resources. The virtual IP address is dynamically assigned from a preconfigured IP address pool.
#=====================================================================
#troubleshoot ssl-vpn tunnel firewall policy

# diagnose  debug  flow  filter addr  INTERNAL_IP_AFTER_VPN_CONNECTION
# diagnose  debug  flow  filter port 443
# diagnose  debug  flow  trace start 100
# diagnose  debug  enable
# diagnose  debug  disable


#=====================================================================
#troubleshoot ssl-vpn tunnel firewall policy

# diagnose  debug  flow  filter clear
# diagnose  debug  flow  filter addr  PUBLIC_IP_ADDRESS
# diagnose  debug  flow trace  start 100
# diagnose  debug  enable
# diagnose  debug  disable

#=====================================================================
#troubleshoot ssl-vpn tunnel firewall policy

Network > Diagnostics > Debug Flow > Advanced
Source IP -> Public IP (what is my public ip?  - web browser)

#start debug
diagnose debug en
diagnose debug flow filter saddr PUBLIC_IP_ADDRESS
diagnose debug flow filter dport 443
diagnose debug flow show function-name enable
diagnose debug flow show iprope enable
diagnose debug flow trace start 10

#stop debug
diagnose debug disable
diagnose debug reset

#=====================================================================
troubleshoot getting no response from the SSL VPN URL:

- Go to VPN -> SSL-VPN Settings.
- Check the SSL VPN port assignment.
- Check the restrict access setting to ensure the host connected from is allowed.
- Go to Policy -> IPv4 Policy or Policy -> IPv6 policy.
- Check that the policy for SSL VPN traffic is configured correctly.
- Check the URL to connect to. It follows this pattern: https://<FortiGate IP>:<Port>
- Check the correct port number in the URL is used. Ensure FortiGate is reachable from the computer.
- ping <FortiGate IP>
-Check the browser has TLS 1.1, TLS 1.2, and TLS 1.3 enabled.
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-Troubleshooting/ta-p/189542?searchString=&from=0&sortby=_score&orderBy=desc&pageNo=1&aggregations=%5B%5D&uid=8021d0dd-1517-11ec-b3e2-0242ac12000d&resultsPerPage=10&exactPhrase=&withOneOrMore=&withoutTheWords=&pageSize=10&language=en&state=1&suCaseCreate=false
#=====================================================================
#Troubleshoot VPN connections, Forticlient, GUI

Network > Diagnostics > Debug Flow > Basic

Network > Diagnostics > Debug Flow > Advanced
#source IP 172.16.7.58
#source IP (internal private ssl vpn tunnel IP)

#=====================================================================
#Troubleshoot VPN connections, Forticlient

#source IP 172.16.7.58
#source IP (internal private ssl vpn tunnel IP)
FW02 # diagnose debug flow filter addr 172.16.7.58
FW02 # diagnose debug flow filter port 443
FW02 # diagnose debug flow show function-name enable
FW02 # diagnose debug flow show iprope enable
FW02 # diagnose debug flow trace start 10
FW02 # diagnose debug enable

#Troubleshoot VPN connections, Forticlient

#CLI
FW02 # diagnose debug flow filter addr 177.166.76.5
FW02 # diagnose debug flow filter port 443
FW02 # diagnose debug flow show function-name enable
FW02 # diagnose debug flow show iprope enable
FW02 # diagnose debug flow trace start 10
FW02 # diagnose debug enable

#GUI
Network > Diagnostics > Advanced (Source IP, Destination IP)
#=====================================================================
#Troubleshoot VPN connections
#https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/993282/troubleshooting-common-issues




# Web

#SSL VPN debug command
diagnose debug application sslvpn -1 # -1 for detailed results.
diagnose debug enable
diagnose debug disable #disable the debug
diagnose debug reset #disable the debug

diagnose test authserver ldap #LDAP authentication test
diagnose debug application fnbamd -1 #diagnose debug application fnbamd -1, Debug LDAP or Radius
diagnose debug reset


diag debug application ike -1
diagnose vpn ike log-filter clear
diagnose vpn ike log-filter dst-addr 1.2.3.4
diagnose debug app ike 255
diagnose debug enable

#IPSEC VPN debug
diagnose vpn ike log filter name diagnose debug app ike -1
diagnose debug enable

FortiGate-KVM # config vpn ssl settings
FortiGate-KVM (settings) # show

# diag debug disable
# diag debug reset
# diag debug application sslvpn -1
# diag debug enable

#Execute the following commands in the FortiGate, connect to SSL VPN and observe the logs.
#Reproduce the issue by observing the logs for errors

# diag debug application sslvpn -1dia
diag debug application fnbamd -1
diag debug enable
diag debug disable

------------------------------------------------------------------------------------------
#HA mode, run on Primary Node

debug non-AD integrated user

FW02 # diagnose debug application sslvpn -1
Debug messages will be on for 30 minutes.
FW02 # diagnose debug enable

stop debug
FW02 # diagnose debug disable
FW02 # diagnose debug reset

debug AD integrated user (more detailed)

FW02 # diagnose debug application sslvpn -1
Debug messages will be on for 20 minutes.
FW02 # diagnose debug application fnbamd -1
Debug messages will be on for 20 minutes.
FW02 # diagnose debug enable

stop debug
FW02 # diagnose debug disable
FW02 # diagnose debug reset
------------------------------------------------------------------------------------------
# get vpn ssl monitor #check the tunnel login, check the web portal login

#check the SSL VPN connection using the GUI
Dashboard > Network and expand the SSL-VPN widget to verify the user’s connection.
Log & Report > System Events and select the VPN Events card to view the details of the SSL VPN connection event log.
Log & Report > Forward Traffic to view the details of the SSL VPN traffic.
#===============================================Show info per connection======================
#FortiOS v7.2.x VPN logs
Log & Report-System Events- VPN Events
#===============================================Show info per connection======================
SSL VPN login hangs or disconnects at 98%

config vpn ssl settings
set login-timeout 180 (default is 30)
set dtls-hello-timeout 60 (default is 10)
end
#====================================================================================================================================
#Authentication/Portal Mapping
Users/Groups -> Portal #Many to one possible; many users/groups to one portal
#====================================================================================================================================
#SSL-VPN tunnel interface -> TRUST policies
all vs SSLVPN_TUNNEL_ADDR1 #both works

Policy & Objects - Addresses - IP Range/Subnet #SSLVPN_TUNNEL_ADDR1
VPN - SSL-VPN Settings - Address Range - Automatically assign addresses #c
#====================================================================================================================================
#case study troubleshooting bard
User works from home remotely and accesses to corporate network via ssl vpn tunneling. User connects with windows credentials in active directory. User accesses to a windows server 2019 in DMZ zone which is not a domain member. In the initial connection user could not connect. domain profile in windows defender firewall on windows server 2019 in DMZ zone was enabled. User could connect. Explain how domain profile activations solves connection problem despite windows server 2019 is not domain member


The Windows Defender Firewall has two profiles: domain and public. The domain profile is used when the computer is connected to a domain network, and the public profile is used when the computer is connected to a public network.

When the user connected to the corporate network via SSL VPN tunneling, their computer was assigned the domain profile in the Windows Defender Firewall. This allowed the user to connect to the Windows Server 2019 in the DMZ zone, even though it was not a domain member.

The reason why the domain profile allowed the user to connect to the Windows Server 2019 in the DMZ zone is because the domain profile includes rules that allow communication with domain controllers and other domain-joined computers. These rules are in place to allow domain users to access resources on the domain network, even if they are not connected to the domain directly.

When the user enabled the domain profile in the Windows Defender Firewall on the Windows Server 2019 in the DMZ zone, it added the same rules to the firewall configuration. This allowed the user to connect to the server, even though it was not a domain member.

It is important to note that the domain profile in the Windows Defender Firewall should only be enabled on computers that are connected to a domain network. If the domain profile is enabled on a computer that is not connected to a domain network, it can open up security vulnerabilities.
#====================================================================================================================================
#case study troubleshooting chatgpt
User works from home remotely and accesses to corporate network via ssl vpn tunneling. User connects with windows credentials in active directory. User accesses to a windows server 2019 in DMZ zone which is not a domain member. In the initial connection user could not connect. domain profile in windows defender firewall on windows server 2019 in DMZ zone was enabled. User could connect. Explain how domain profile activations solves connection problem despite windows server 2019 is not domain member

Even though the Windows Server 2019 in the DMZ zone is not a domain member, the activation of the domain profile in Windows Defender Firewall can still solve the connection problem for the user accessing the server remotely through SSL VPN tunneling. The domain profile activation plays a role in facilitating communication and security, even when the server itself is not directly part of the domain.

Here's how the domain profile activation helps to solve the connection problem:

Windows Defender Firewall Profiles:

Windows Defender Firewall has three main profiles: Domain, Private, and Public. Each profile is designed to apply appropriate firewall rules based on the network's categorization. The activation of the domain profile tells Windows Defender Firewall that the computer is connected to a trusted network domain.

SSL VPN Tunneling and Remote Access:

When the remote user establishes an SSL VPN tunnel to access the corporate network, the user's computer effectively becomes part of the corporate network's domain, even though the specific server in the DMZ is not a domain member. This is achieved through the SSL VPN's secure tunnel, which extends the user's local network to the corporate network.

Domain Profile Activation:

Enabling the domain profile in Windows Defender Firewall is important because it allows the server to differentiate between incoming connections from trusted internal sources (the corporate network and the SSL VPN tunnel) and connections from external, untrusted networks.

Connection Problem Resolution:

Initially, when the domain profile was not activated on the Windows Server 2019 in the DMZ, the firewall treated the incoming connection from the remote user as if it was coming from an untrusted network (public or private profile). This likely resulted in stricter security rules that blocked or limited the connection attempt.

By activating the domain profile, Windows Defender Firewall recognizes that the incoming connection is from the corporate domain, which is considered trusted. As a result, it relaxes certain security measures, allowing the remote user's connection to pass through more easily.

Network Trust Levels:

The domain profile activation helps establish a sense of trust between the remote user's computer and the Windows Server 2019, even though the server itself is not a domain member. This trust is based on the assumption that the SSL VPN tunneling effectively extends the corporate domain's network environment to the user's computer.

In summary, activating the domain profile in Windows Defender Firewall allows the server to treat connections from the SSL VPN tunnel as if they were coming from the trusted corporate domain. This adjustment in firewall rules and security settings solves the connection problem by enabling the necessary communication while maintaining a level of security appropriate for trusted network domains.
#====================================================================================================================================