0

I have to use Fortigate's SSL VPN client for Windows (version 5.4.1.0840) to connect to our corporate network.

One of the most annoying things about this software is that whenever the VPN client disconnects and reconnects to the remote VPN gateway it trashes all my SSH sessions. This can happen two or three times a day due to transient connectivity issues between me and the datacenter.

Despite all my remote servers having the following configured in sshd_config:

TCPKeepAlive yes
ClientAliveInterval 300
ClientAliveCountMax 10

And in my SSH client's ssh_config:

Host *
     ServerAliveInterval 300
     ServerAliveCountMax 10

Whenever the VPN client briefly disconnects and automatically reconnects immediately my SSH session(s) die with:

kevin@my.remote.server.com ~
$ Connection reset by 1.2.3.4    
@BUZZ2 ~
$

The IP address 1.2.3.4 is the Linux server I was connected to over SSH.

This happens using the PuTTY, Cygwin and the Ubuntu bash (Windows Subsystem for Linux) SSH clients.

If I test against a local server here and then either yank my ethernet cable or drop the wifi briefly then the SSH client and server successfully smooths over the brief loss of connectivity. My connection doesn't get trashed, it's just this Fortigate VPN client that seems to completely trash my sessions.

FYI: The remote Fortigate gateway is a Fortigate 600C running firmware 5.2.5 build 701.

To get around this issue I use tmux on my remote servers so that when I reconnect whatever I was doing hasn't been blown away. However when I've got ten or fifteen SSH session on the go it does become a tiresome exercise to SSH back into the server and reconnect to my tmux sessions.

Is this just the nature of this particular VPN product or is there a config setting I can change either in the VPN client or the Fortigate 600's that will prevent it from completely wrecking my SSH connections?

  • 1
    On the ingress policy for the VPN tunnel, is there a SSL Inspection profile enabled on it? And if so, try turning off that profile to see if it helps. It might be interfering with the SSH session. – ecnepsnai Sep 7 '16 at 14:48
  • @ecnepsnai thanks I pass that onto our network team to see what they say. – Kev Sep 8 '16 at 9:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.