Evaluation Licence VPN SSL

[rogermijares]

Doesn anybody know if the VPN SSL can be setup in fortigate that is runnig 7.4 with a evaluation licence ?

This is error thta I am getting

unable to establish the vpn connection, The VPN server is unreachable or your identity certificat is not trusted (-5)

Thanks in advance..

[ndumaj]

Hello Rogermijares,

enable the following debug on FGT to investigate:

diag debug console timestamp enable

diag debug app fnbamd -1

diag debug app sslvpn -1

diag debug enable

BR

[ndumaj · Accepted solution]

Additionally, review the following articles:

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/943479/certificate-based-authentication
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-solve-The-server-you-want-to-connec...

https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-tls-handshake-failures-in-ou...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-control-the-SSL-version-and-cipher-...
-BR-

[pminarik]

If you're talking about the unlicensed VM that anyone can download and run:

In theory: Yes.

In practice: No, almost impossible.

Unlicensed VMs have significant restrictions to which crypto algorithms they allow, which makes most cryptography-utilizing features unusable. SSL-VPN specifically will offer only bad and outdated algorithms during the handshake, which will be rejected by any modern client. If you can convince/reconfigure your client to negotiate these outdated ciphers, it should work. (this is the "in theory" answer)

------

If on the other hand you meant a fully functional evaluation license (a proper VM license just like any other, except time limited to permanently expire somewhere between a month and a year), then those should work just fine (no crypto limitations). In this case you should follow up with troubleshooting as outlined by @ndumaj .

[rogermijares]

I am using the VM evaluation licence which doesnt expire. This is for a home lab and I want to learn the product but if I cant setup a simple VPN server this licence is rubbish. I am better off with sophos, I reckon.....

[pminarik]

Unfortunately, VPNs are the two features most impacted in trial VMs. :(

If you have some contacts via your employment, you could try obtaining the full evaluation license. A used hardware FortiGate is another option, as these don't have crypto restrictions, even with expired support contracts. Alternatively, if your aim is trying out VPNs in general, FortiClient should let you easily set crypto settings for IPsec that will be compatible with a trial VPN.