Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    forticlient - dtls

    Scheduled Pinned Locked Moved General pfSense Questions
    12 Posts 3 Posters 1.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      eoyen @NollipfSense
      last edited by eoyen

      @NollipfSense dtls, tls using udp

      I can get the logs from the client later today.

      I have created a case with fortinet

      10/7/2023 11:01:12 AM info sslvpn FortiSslvpn: 5384: PreferDtlsTunnel=1
      10/7/2023 11:01:17 AM error sslvpn FortiSslvpn: 5384: error: SslBlockingRead() timeout. (tm=5000, n=-1)
      10/7/2023 11:01:17 AM info sslvpn FortiSslvpn: 5384: PreferDtlsTunnel=1
      10/7/2023 11:01:23 AM error sslvpn FortiSslvpn: 5384: error: SslBlockingRead() timeout. (tm=5000, n=-1)
      10/7/2023 11:01:23 AM info sslvpn FortiSslvpn: 5384: PreferDtlsTunnel=1
      10/7/2023 11:01:28 AM error sslvpn FortiSslvpn: 5384: error: SslBlockingRead() timeout. (tm=5000, n=-1)
      10/7/2023 11:01:28 AM info sslvpn FortiSslvpn: 5384: PreferDtlsTunnel=1
      10/7/2023 11:01:34 AM error sslvpn FortiSslvpn: 5384: error: SslBlockingRead() timeout. (tm=5000, n=-1)
      10/7/2023 11:01:36 AM info sslvpn FortiSslvpn: 5384: PreferDtlsTunnel=1
      10/7/2023 11:01:41 AM error sslvpn FortiSslvpn: 5384: error: SslBlockingRead() timeout. (tm=5000, n=-1)

      NollipfSenseN 1 Reply Last reply Reply Quote 0
      • NollipfSenseN
        NollipfSense @eoyen
        last edited by

        @eoyen Are you using dtls 1.2 or 1.3?

        pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
        pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

        E 2 Replies Last reply Reply Quote 0
        • E
          eoyen @NollipfSense
          last edited by eoyen

          @NollipfSense

          set ssl-max-proto-ver tls1-3
          set ssl-min-proto-ver tls1-2

          set dtls-max-proto-ver dtls1-2
          set dtls-min-proto-ver dtls1-0

          so 1.2

          1 Reply Last reply Reply Quote 0
          • E
            eoyen @NollipfSense
            last edited by

            @NollipfSense

            Hi, did you have any ideas to what the problem could be?

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              If this is just an SSL VPN using UDP encapsulation or similar pfSense should just pass it. It doesn't care what's in the packets.

              Try running a pcap for that traffic on the LAN and then the WAN. Make sure you see two way traffic on both interfaces.

              About the only thing I could imagine breaking it might be some MTU issue. But even then most connections would simply reduce their packet size to allow for it. UDP can fail in that situation where TCP would not.

              Steve

              E 1 Reply Last reply Reply Quote 0
              • E
                eoyen @stephenw10
                last edited by eoyen

                @stephenw10 thank you

                looks like it could be related to mtu, i have also tried to set mtu manully on the interfaces but that did not change anything

                UDP, bad length 1774 > 1472

                1538fc87-94e8-426f-a87a-4c7171882833-image.png

                also found this as known issue for the latest version of forticlient

                954004 DTLS tunnel cannot establish when handshake packet has a large MTU.

                downgraded forticlient to version FortiClientVPNSetup_7.0.9.0493_x64
                did not help.

                E 1 Reply Last reply Reply Quote 0
                • E
                  eoyen @eoyen
                  last edited by

                  This post is deleted!
                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    What are the MTUs of the interfaces involved here? Where are you seeing that bad length error? Are you running the client on MacOS?

                    E 1 Reply Last reply Reply Quote 0
                    • E
                      eoyen @stephenw10
                      last edited by eoyen

                      @stephenw10

                      hi so after some more testing bypassing the pfsense box it turned out that the FortiClient version running on my laptop was older and handled automatically fallback to tcp better then the newer clients.
                      so using a new client on the laptop directly on the modem in bridge mode still doesn't work, so pfsense is not the problem.

                      so the issue is either the modem provided by the isp or a problem somewhere in their infrastructure

                      UDP, bad length is displayed in the status window on pfsense when doing packet capture for the udp connection.

                      client on windows only.
                      mtu is not configured to any specific value.

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Well you might be able to force it by setting the interface MTU sufficiently small on the interface closest to the laptop. Or on the laptop itself.

                        There are a lot of reports of it being broken in the Fortinet client though.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.