Many SSL-VPN connections disconnected in one minute
Our company using ssl-vpn with two Fortigate (v6.4.0 build1579 (GA)) VMs running on Azure.
A total of about 1,500 users are usually connected them from home and have been in operation for about a year and a half.
But 2 weeks ago, around 12:23 p.m. most SSL-VPN sessions were suddenly disconnected in one minute.
Fortigate did not reboot and not out of memory situation during that time, and there was no system error output to syslog.
(We restart Fortigate every midnight for stable operation.)
We thought Azure environment might suspiciously, but MS support said that there was no failure in that time zone.
Have anyone experienced similar symptoms?
syslog shows many ssl-vpn disconnect messages like below, 2021/09/23 12:23:50 info sslvpn FortiSslvpn: 3100: Ras: connection to fortissl terminated2021/09/23 12:23:50 info system date=2021-09-23 time=12:23:50 logver=1 id=96900 type=traffic subtype=system eventtype=traffic level=info uid=E9EF612AC25543EA9D4E592B22C8C028 devid=FCT8001341169323 hostname=XXXXX pcdomain=XXXXX deviceip=192.168.0.199 devicemac=XXXXX site=N/A fctver=7.0.1.0083 fgtserial=FCT8001341169323 emsserial=N/A os="Microsoft Windows 10 Professional Edition, 64-bit (build 19041)" user=XXXXX@JP msg="Traffic log" sessionid=1638598077 srcname=sslvpn srcip=192.168.0.199 srcport=0 direction=outbound dstip=XXXX.co.jp dstport=1443 proto=6 rcvdbyte=99044287122 sentbyte=47306357542 utmaction=passthrough utmevent=vpn threat=disconnect userinitiated=0 browsetime=02021/09/23 12:32:01 info sslvpn FortiSslvpn: 6672: fortissl_connect: device=ftvnic2021/09/23 12:32:01 info sslvpn FortiSslvpn: 16740: PreferDtlsTunnel=0
post edited by ALSI ITPF3 - 2021/10/07 16:48:26