Helpful Replyssl-vpn on FG200D

Author
cparfon
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/01/21 03:10:17
  • Status: offline
2015/01/21 07:11:07 (permalink)
0

ssl-vpn on FG200D

Hello,
 
I have a issue with one of our companies people, which has to work from China. We have a FG200D and it's running a ssl-vpn. All our employees are able to connect to the office network through the SSL-VPN but this one fella which works from China isn't able to connect. I'm very much aware that in China they have lots of restrictions but I was just looking for a way to work this out somehow. Any ideas?
 
Thanks.
#1
Christopher McMullan_FTNT
Gold Member
  • Total Posts : 415
  • Scores: 34
  • Reward points: 0
  • Joined: 2014/09/08 08:00:33
  • Status: offline
Re: ssl-vpn on FG200D 2015/01/21 07:15:14 (permalink)
0
What port do users target to connect to the SSLVPN? If 10443 is the default, I would consider changing it to 443, and move the HTTPS GUI management port to 444, or 10443.
 
I used the SSLVPN web portal on my home firewall to do some proxy browsing from Cuba while on vacation a couple years back, and I made sure to set the port to 443 in case other ports were blocked.
 
Otherwise, try a sniff, flow trace, and debug of the sslvpn daemon sequentially to see what's happening:
di sniff pack any "host w.x.y.z and port 443" 4 //--replace w.x.y.z with the public IP of the FortiGate people target for their SSLVPN connections
<attempt a connection, then press Ctl+C to stop the capture>
 
di de reset
di de en
di de fl s c en
di de fl s f en
di de fl filter addr w.x.y.z //--same as above
di de fl filter port 443 //--same as above
di de fl tr start 5000
di de fl tr stop //--type this without pressing Enter, so you can easily stop the flow trace later regardless of how much output is flying by
<attempt a connection, then...>
di de fl filter clear
di de reset
 
di de app sslvpn -1
<attempt a connection, then...>
di de reset
di de di

Regards,
Chris McMullan
Fortinet Ottawa
#2
cparfon
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/01/21 03:10:17
  • Status: offline
Re: ssl-vpn on FG200D 2015/01/22 05:35:38 (permalink)
0
Hi Christopher,
 
First, thank you for taking the time to answer my question.
 
Second, to answer your question, we DO USE port 443 for the users to connect to the SSLVPN, and it works flawlessly for all of them, except for this one person which is located in China (Beijing).
 
I did as you suggested and here's the traffic capture done during the connection attempt of that person from China (atached to this post).
Btw, the public IP address in that capture belongs to our employee in China.
Also, here's  `FortiClient` client log:
 
1/7/2015 6:24:42 PM Notice FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled"
1/7/2015 6:24:42 PM Notice VPN id=96602 msg="SSLVPN service started successfully." vpntype=ssl
1/7/2015 6:24:57 PM Warning FortiShield id=96855 msg="FortiShield blocked application: FortiClientOnl from modifying: \\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Fortinet\\FortiClient\\FA_UPDATE\\SoftwareUpdate\\IgnoreVersion"
1/7/2015 7:26:50 PM Notice VPN date=2015-01-07 time=19:26:49 logver=1 type=traffic level=notice sessionid=25224176 hostname=P15P2GL-01 uid=E2BFA8B9FF2B4936924567E70ABDCDA5 devid=FCT8002984563811 fgtserial=N/A regip=N/A srcname=sslvpn srcip=N/A srcport=N/A direction=outbound remoteip=XX.XX.XX.XX remotename=N/A remoteport=443 url=N/A user=N/A proto=ssl rcvdbyte=1982452785 sentbyte=0 utmaction=passthrough utmevent=vpn threat=connect vd=N/A
1/7/2015 7:26:51 PM Notice VPN date=2015-01-07 time=19:26:50 logver=1 type=traffic level=notice sessionid=25224176 hostname=P15P2GL-01 uid=E2BFA8B9FF2B4936924567E70ABDCDA5 devid=FCT8002984563811 fgtserial=N/A regip=N/A srcname=sslvpn srcip=N/A srcport=N/A direction=outbound remoteip=XX.XX.XX.XX remotename=N/A remoteport=443 url=N/A user=lan.liu proto=ssl rcvdbyte=4294967296 sentbyte=0 utmaction=passthrough utmevent=vpn threat=disconnect vd=N/A
1/7/2015 7:27:05 PM Error VPN FortiSslvpn: 50416: Ras : connection to fortissl failed : 680:2:There was no dial tone.
1/7/2015 7:39:53 PM Error VPN FortiSslvpn: 45460: Ras : connection to fortissl failed : 0:0:
1/7/2015 7:44:01 PM Error VPN FortiSslvpn: 44504: Ras : connection to fortissl failed : 0:0:
1/7/2015 9:30:18 PM Error VPN FortiSslvpn: 25580: Ras : connection to fortissl failed : 0:8193:
1/7/2015 9:42:47 PM Error VPN FortiSslvpn: 34500: Ras : connection to fortissl failed : 0:0:
1/16/2015 4:06:42 AM Notice FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled"
1/16/2015 4:06:45 AM Notice VPN id=96602 msg="SSLVPN service started successfully." vpntype=ssl
1/19/2015 8:20:35 AM Notice FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled"
1/19/2015 8:20:38 AM Notice VPN id=96602 msg="SSLVPN service started successfully." vpntype=ssl
1/20/2015 8:43:39 AM Notice FortiShield id=96851 user=DBLOG_SOURCE_SYSTEM msg="FortiShield is enabled"
1/20/2015 8:43:43 AM Notice VPN id=96602 msg="SSLVPN service started successfully." vpntype=ssl
1/22/2015 7:24:52 PM Notice VPN date=2015-01-22 time=19:24:51 logver=1 type=traffic level=notice sessionid=30401100 hostname=P15P2GL-01 uid=E2BFA8B9FF2B4936924567E70ABDCDA5 devid=FCT8002984563811 fgtserial=N/A regip=N/A srcname=sslvpn srcip=N/A srcport=N/A direction=outbound remoteip=XX.XX.XX.XX remotename=N/A remoteport=443 url=N/A user=N/A proto=ssl rcvdbyte=2000081969 sentbyte=0 utmaction=passthrough utmevent=vpn threat=connect vd=N/A
1/22/2015 7:24:52 PM Notice VPN date=2015-01-22 time=19:24:52 logver=1 type=traffic level=notice sessionid=30401100 hostname=P15P2GL-01 uid=E2BFA8B9FF2B4936924567E70ABDCDA5 devid=FCT8002984563811 fgtserial=N/A regip=N/A srcname=sslvpn srcip=N/A srcport=N/A direction=outbound remoteip=XX.XX.XX.XX remotename=N/A remoteport=443 url=N/A user=lan.liu proto=ssl rcvdbyte=4294967296 sentbyte=0 utmaction=passthrough utmevent=vpn threat=disconnect vd=N/A
1/22/2015 7:25:05 PM Error VPN FortiSslvpn: 17668: Ras : connection to fortissl failed : 0:8193:
1/22/2015 7:28:34 PM Error VPN FortiSslvpn: 16548: Ras : connection to fortissl failed : 0:0:
1/22/2015 7:32:48 PM Error VPN FortiSslvpn: 13132: Ras : connection to fortissl failed : 0:0:
#3
Christopher McMullan_FTNT
Gold Member
  • Total Posts : 415
  • Scores: 34
  • Reward points: 0
  • Joined: 2014/09/08 08:00:33
  • Status: offline
Re: ssl-vpn on FG200D 2015/01/22 06:20:51 (permalink)
0
Does it make any difference if they try connecting via a web browser to the SSLVPN web portal instead of using FortiClient?
 
That'll help narrow the issue down, to see if a connection is possible at all, and then if so, why not with FortiClient?
#4
cparfon
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/01/21 03:10:17
  • Status: offline
Re: ssl-vpn on FG200D 2015/01/22 06:46:21 (permalink)
0
We have also tried SSLVPN web portal. Unfortunately no luck with it also. :(
#5
Christopher McMullan_FTNT
Gold Member
  • Total Posts : 415
  • Scores: 34
  • Reward points: 0
  • Joined: 2014/09/08 08:00:33
  • Status: offline
Re: ssl-vpn on FG200D 2015/01/22 07:36:57 (permalink)
0
Has the client ever been able to successfully connect to the SSLVPN using FortiClient in the past, and/or from some other location?
#6
cparfon
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/01/21 03:10:17
  • Status: offline
Re: ssl-vpn on FG200D 2015/01/22 07:39:14 (permalink)
0
Yes. Everywhere outside China. :|
#7
Christopher McMullan_FTNT
Gold Member
  • Total Posts : 415
  • Scores: 34
  • Reward points: 0
  • Joined: 2014/09/08 08:00:33
  • Status: offline
Re: ssl-vpn on FG200D 2015/01/22 08:13:19 (permalink)
0
Just that the FortiClient output for the fortissl adapter stands out as odd to me: no dialtone?
 
Thinking outside the box, I'm wondering if IPsec could get through, or else just using the web portal with a connection tool or bookmarks to access internal resources as one workaround.
 
Can they get to the web portal at least, or nothing at all through the browser?
#8
cparfon
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/01/21 03:10:17
  • Status: offline
Re: ssl-vpn on FG200D 2015/01/22 08:25:23 (permalink)
0
Yeah. They are able to access the FG VPN web portal and connect. But nothing apparently works. 
Looking at logs when they connect to the portal I can see this:
 
 
date=2015-01-22 time=13:47:46 logid=0101039424 type=event subtype=vpn level=information vd="root" action="tunnel-up" tunneltype="ssl-web" tunnel_id=179308386 remote_ip=123.116.47.242 tunnel_ip=(null) user="lan.liu" group="vpn_usergroup" dst_host="N/A" reason="login successfully" msg="SSL tunnel established"
date=2015-01-22 time=13:47:45 logid=0101039943 type=event subtype=vpn level=information vd="root" action="ssl-new-con" tunneltype="ssl" tunnel_id=0 remote_ip=123.116.47.242 tunnel_ip=(null) user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL new connection"
#9
sensorsinc
New Member
  • Total Posts : 18
  • Scores: 0
  • Reward points: 0
  • Joined: 2011/04/07 11:07:11
  • Status: offline
Re: ssl-vpn on FG200D 2015/01/30 13:07:26 (permalink) ☄ Helpfulby Holy 2015/02/01 15:27:03
0
China recently "upgraded" their Great Firewall and is actively monitoring and blocking VPNs in real-time.
 
http://techcrunch.com/2015/01/23/china-vpn-crackdown/
http://www.wsj.com/articles/chinas-great-firewall-gets-taller-1422607143
 
There are VPN providers who are actively working around the issue.  Astrill (https://www.astrill.com) for example is supposed to work on everything but iOS.
 
I just started my search here to see what FortiNet is doing about it. 
 
If anyone knows of an official response from FortiNET I would like to hear about it.
 
Good luck!
#10
Jump to:
© 2019 APG vNext Commercial Version 5.5