We're running a Fortigate 100D, and having some trouble with the SSL VPN via FortiClient.

I installed FortiClient on an external Windows 7 PC a few days pack and the SSL VPN connected and worked.

I uninstalled it from that PC and installed it on a different external Windows 7 PC, and now cannot connect to the VPN. I get this error when it attempts to connect:

Unable to logon to the server. Your username or password may not be properly configured for this connection. (-12)

Google was pretty unhelpful.

We have tried it on two external Windows systems now, and get the same error on both systems.

There does not appear to be any information in the firewall's event logs/vpn logs.

The client gives this

7/10/2013 3:20:08 PM Debug ESNAC Start searching for FGT
7/10/2013 3:20:08 PM Debug ESNAC Socket connect failed
7/10/2013 3:20:08 PM Debug ESNAC
7/10/2013 3:20:10 PM Debug ESNAC Socket connect failed
7/10/2013 3:20:10 PM Debug ESNAC
7/10/2013 3:20:10 PM Debug ESNAC End searching for FGT

Not sure what is preventing the VPN from connecting.

Edit: We have reset the password for the user - and are 100% sure that we have a correct username and password. In fact it is happening with two different accounts, both of which worked previously.

  • 1
    Did you reset the password for the user?
    – brandeded
    Jul 11, 2013 at 11:05
  • Do the server logs give any hint?
    – Jenny D
    Jul 11, 2013 at 13:29

7 Answers 7


Discovered that the problem was that I had special characters in my password. There was never any indication that special characters were not permitted, but sure enough, when I reset the password to something alphanumeric, it works.

  • How to reset and add a new password for the account using the fortiClient? Jan 7, 2019 at 10:34

Also... if you do not have the Tunnel Mode allowed in the SSL Portal configuration for that particular Portal. As soon as I added it in I could connect with the full SSL VPN client.

  • I had no problems with special characters in the password. Firmware is 5.4. But allowing tunnel-mode was the key for me.
    – skinneejoe
    May 15, 2018 at 20:37


As the error states itself the most common problem is that either the username or the password isn't matching the one of the device.

Other problems might be:

  • the user is not in the correct user group that has VPN access (either the local firewall group or the LDAP server group if you’re using one)
  • there isn't a corresponding firewall policy rule that allows access for the user group to any of the internal networks. You need to have the rule from the wan interface to one of the internal interfaces with action SSL-VPN and select the group of users which will have access, check if your user is in correct group.
  • you might be trying to connect to VPN from the wrong side of the interface (from one of your internal networks or from the network of one of the sites you already have a site to site connection

I also experienced this issue, after a lot of trying I found out that the cause was that the user had a pending change of password in the domain.

After changing the password unchecking the user must change the password on next login it worked fine again.


Another solution I found that works for me:

I had initially a long password: 15 chars

Resetting it to a shorter one ( 10 chars) also removed that error, and enabled the login.


otra solucion

1-no escribir el username de A.D. si no que debe ser el Display name

2-la cuenta de usuario no debe tener configurada Log On To

[Terrible translation from Google Translate; is there a Spanish speaker in the house?]

One other solution:

  1. use the display name rather than the AD username
  2. The user account must be configured not Log On To

I had same issue

My Licence had expired and upon renewal, SSL vpn started working as usual.

  • 2
    When your license expired, you got the error message "Your username or password may not be properly configured for this connection"? Or did you get a different error message?
    – Ladadadada
    Jun 19, 2014 at 12:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .