Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're running a Fortigate 100D, and having some trouble with the SSL VPN via FortiClient.

I installed FortiClient on an external Windows 7 PC a few days pack and the SSL VPN connected and worked.

I uninstalled it from that PC and installed it on a different external Windows 7 PC, and now cannot connect to the VPN. I get this error when it attempts to connect:

Unable to logon to the server. Your username or password may not be properly configured for this connection. (-12)

Google was pretty unhelpful.

We have tried it on two external Windows systems now, and get the same error on both systems.

There does not appear to be any information in the firewall's event logs/vpn logs.

The client gives this

7/10/2013 3:20:08 PM Debug ESNAC Start searching for FGT
7/10/2013 3:20:08 PM Debug ESNAC Socket connect failed
7/10/2013 3:20:08 PM Debug ESNAC 0.0.0.0
7/10/2013 3:20:10 PM Debug ESNAC Socket connect failed
7/10/2013 3:20:10 PM Debug ESNAC 192.168.1.1:8010
7/10/2013 3:20:10 PM Debug ESNAC End searching for FGT

Not sure what is preventing the VPN from connecting.

Edit: We have reset the password for the user - and are 100% sure that we have a correct username and password. In fact it is happening with two different accounts, both of which worked previously.

share|improve this question
1  
Did you reset the password for the user? –  mbrownnyc Jul 11 '13 at 11:05
    
Do the server logs give any hint? –  Jenny D Jul 11 '13 at 13:29

6 Answers 6

up vote 5 down vote accepted

Discovered that the problem was that I had special characters in my password. There was never any indication that special characters were not permitted, but sure enough, when I reset the password to something alphanumeric, it works.

share|improve this answer

http://adminramble.com/common-forticlient-ssl-vpn-errors/

As the error states itself the most common problem is that either the username or the password isn't matching the one of the device.

Other problems might be:

  • the user is not in the correct user group that has VPN access (either the local firewall group or the LDAP server group if you’re using one)
  • there isn't a corresponding firewall policy rule that allows access for the user group to any of the internal networks. You need to have the rule from the wan interface to one of the internal interfaces with action SSL-VPN and select the group of users which will have access, check if your user is in correct group.
  • you might be trying to connect to VPN from the wrong side of the interface (from one of your internal networks or from the network of one of the sites you already have a site to site connection
share|improve this answer

Another solution I found that works for me:

I had initially a long password: 15 chars

Resetting it to a shorter one ( 10 chars) also removed that error, and enabled the login.

share|improve this answer

Also... if you do not have the Tunnel Mode allowed in the SSL Portal configuration for that particular Portal. As soon as I added it in I could connect with the full SSL VPN client.

share|improve this answer

otra solucion

1-no escribir el username de A.D. si no que debe ser el Display name

2-la cuenta de usuario no debe tener configurada Log On To

[Terrible translation from Google Translate; is there a Spanish speaker in the house?]

One other solution:

  1. use the display name rather than the AD username
  2. The user account must be configured not Log On To
share|improve this answer

I had same issue

My Licence had expired and upon renewal, SSL vpn started working as usual.

share|improve this answer
1  
When your license expired, you got the error message "Your username or password may not be properly configured for this connection"? Or did you get a different error message? –  Ladadadada Jun 19 at 12:30

protected by HopelessN00b Jun 19 at 10:19

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.