We are currently experiencing this issue with some of the VPN clients.
On my machines (mac and windows), I’m able to connect to VPN without any problem. But my colleague located overseas is having a “Credential or SSLVPN configuration is wrong (-7200)” error even though we are using the same account. I also tried to export the config and pass it to him but still the same error.
The weird thing is the VPN works 2 weeks ago. But all of a sudden he can no longer use it.
Had this issue popup today. Issue was with firewall policy not allowing the SSLVPN interface in the “From” field destined “To” the internal network (due to many policy edits, it was left out on accident.)
The VPN is authenticating, then being blocked by firewall policy: Technically the “SSLVPN configuration is wrong”, but the error is pretty useless in this context.
Check the version of forticlient that is being used by your colleague.
I’ve seen where a newer version/update can cause the error, or vice versa depending on the firmware version on the fortigate.
I just started encountering the same issue. I have a client that uses the VPN from multiple locations. We got it working at one after initially having this message. The other location however still shows the same message.
I got it working at the one by changing her password on the LDAP server but I do not want to do that again in fear of making this location work and the other one stops working.
While doing this we also had to setup 2FA again because that stopped working.
-Press the Win+R keys enter inetcpl.cpl and click OK.
-Select the Advanced tab-Click the Reset… button. If the Reset Internet Explorer settings button does not appear, go to the next step.
-Click the Delete personal settings option
-Click Reset-Open Internet Options again.
-Go back to Advanced tab-Disable use TLS 1.0 (no longer supported)
-Go to the Security tab in Internet Options and choose Trusted sites then click the button Sites. Insert the SSL-VPN gateway URL into Add this website to the zone and click Add, here like https://sslvpn_gateway:10443 as placeholder.
-The SSL state must be reset, go to tab Content under Certificates. Click the Clear SSL state button.
I think the moral of the story is there are about 1000 different things this error could mean. In my case, it was because the user who was trying to log in wasn’t a part of any of the RADIUS groups that had been assigned to a portal in the SSL VPN portal mapping section.
You would think there would be a somewhat more obvious/specific error for that, but eh.
i had same issues, it was Microsoft defender(antivirus) i just disabled the real-time protection working well, this is not the solution for many others as i saw from answer, but you can count on it, and the Fortinet need to work on error precisions or log output for more debug pathway.
just to add on this… just in case anyone else having the same issue and especially most of the times only affected overseas colleague.
my only fix is to set remoteauthtimeout to 300 (default was 5 second according to TAC, I was running this on version 6.2.12, i have to reenter this config again when I updated to 7.0.11 yesterday as issue comes back after firmware update somehow.)
config sys global
set remoteauthtimeout 300
end
its a very annoying issue, as the debug shows that fortigate cannot match the user to a group… but the issue is actually it just drops user lookup after it hits remoteauthtimeout limit, affects mostly overseas worker as probably latency etc.
