Troubleshooting VPN

With the tools we have explained, we are able to troubleshoot VPN connections. We can start with SSL VPN debugging and follow the steps suggested in the Debugging FortiGate configurations document (http://docs.fortinet.com/cb/html/index.html#page/FOS_Cookbook/Install_advanced/cb_ts_debug.html). The steps are as follows:

1. Verify the current debug configuration with the diagnose debug info command.

2. Display debug messages for SSL VPN using the diagnose debug application sslvpn -1 command.

3. Use diagnose debug enable to display debug messages.

Any error will be shown on screen. To debug an IPSEC site-to-site VPN connection, a good list of steps is the one posted by Yuri Slobodyanyuk in his blog: http://bit.ly/hzREm1. The steps are as follows:

1. Open an SSH session on the FortiGate unit.

2. Execute diagnose debug enable to enable debugging.

3. Execute diagnose debug app ike -1 to verify IKE errors.

4. Execute diagnose sniffer packet any <IP of the remote LAN> to activate packet sniffing.

5. Open...