[SOLVED] RDP through VPN SSL doesn't work anymore

[ladeth]

We have a Fortigate 110C configured for Remote Access. We have configured Web Access Portal and published a bookmark to access a Windows 2008 R2 virtual Machine with RDP Native protocol. All was working fine when the Fortigate was under FortiOS 4.0 MR3 Patch 10. Since we upgraded our firewall to FortiOS 5.2.2, we are now unable to connect through RDP. When we use RDP Native, after having clicked on the bookmark, we are prompted to enter the Windows 2008 user and password. Then, the dialog box displays "Securing remote connection" indefinitely and never displays the Remote Desktop. When we use RDP, after having provided the required information, a Java applet is started, we can see the Remote Desktop for 1 or 2 seconds and the Java applet crashes with the following error messages :

    - javax.net.ssl.SSLException Connection has been shutdown: javax.net.ssl.SSLException:javax.net.ssl.SSLException: Software caused connection abort: recv failed (see attached screen capture)     - javax.net.SocketException Software caused connection abort: recv failed      The Remote Desktop to the Windows 2008 R2 works fine from a computer located in the same LAN than the virtual machine.      Does anyone have the same issue ? Thanks in advance for your help.

[Dave_Hall]

Just curious to know if you followed the recommended upgrade path to go from 4.3.10 to 5.2.2? Also, the patch notes for the 5.2.0 has some notes on SSL/VPN that you may want to recheck/look into.

[ladeth]

Hello Dave,

thanks for your reply.  Reading th recommended upgrade path, it seems I missed one intermediate patch. Next week, I'll re-install my Fortigate in FortiOS 4.0 MR3 Patch 10 and try a new upgrade following strictly the upgrade path.

Regards.

[Chura]

Hi Actually, you just hit bug I belive. I have the same problem exactly but i upgraded from 5.0.7 to 5.0.10 and had the same problem, then tried 5.2.2 and same problem. Last stable firmware that NativeRDP still works is 5.0.7. Can you please open ticket for this? My machine is now back on 5.0.7 and I can't debug with the TAC team. My ticket is still ongoing.

[ladeth · Accepted solution]

Hello,

RDP through VPN SSL is now working fine on my Fortigate 110C Cluster with FortiOS 5.2.2. Here's the solution I've applied (thanks to Dave for the idea...) :

[ul]

Reverted back my FG110C cluster to FortiOS 5.0.6 (this is the older backup file I have for this cluster) => RDP VPN SSL is working fine.

Upgraded my cluster to 5.2.2, applying ALL the patches between 5.0.6 and 5.2.2 (i.e. : 5.0.6 => 5.0.7 => 5.0.8 => 5.0.9 => 5.0.10 => 5.2.0 => 5.2.1 => 5.2.2) and RDP VPN SSL is working fine at each step of the upgrade path.[/ul]

Hope this can help someone else...

[Phuoc_Ngo]

Any other work around for this issue beside reverting back the old firmware and redo the entire process.?

We upgrade our version from 5.0.11 to 5.2.1.  We can't take our production environment down just to test.

[Chura]

One workaround I know of, is to install another machine on the network as VM with older version and make the SSLVPN there.

Fortinet identified this as BUG (I can't get the number for you since the ticket system is down for maintenance)

I have information that it will be fixed at 5.2.3 that will be out mid February.

[Phuoc_Ngo]

Thank you for the Bug fix information Chura.

When you have a chance, can you let us know the bug fix number for this issue?  I had ticket open with support but the support engineer doesn't seem to be aware of the bug.

Regards,

Phuoc

[Chura]

BugID#0265504

[Phuoc_Ngo]

Thank you for the Bug number Chura.