With the above in mind, the following is an overview of the events leading up to (and explaining) the SSL-VPN connection failure (skip to the bottom of this article for the summarized solution).ġ) As mentioned in the key details, Windows 11 uses TLS 1.3 by default for outbound TLS connections. This setting dictates what the minimum acceptable strength is for the encryption cipher being used for SSL-VPN, and it is based upon the number of bits used in the encryption keys. When an SSL-VPN Authentication/Portal Mapping is created, a setting called cipher is present in the CLI and is set to high by default. The ciphersuite setting (found under config vpn ssl settings on the FortiGate) governs the list of supported TLS Cipher Suites used for TLS 1.3 connections specifically (it has no bearing on TLS 1.2 or lower SSL-VPN Connections). Windows 11 is uses TLS 1.3 by default for outbound TLS connections, whereas Windows 10 appears to use TLS 1.2 by default. Users are unable to authenticate if they are in a User Group that is configured in an SSL-VPN Authentication/Portal Mapping (aka 'authentication-rule' in the CLI), but they can successfully authenticate when using the 'All Other Users/Groups' catch-all authentication rule.Īs a primer, be aware of the following key details:

More specifically, the TLS-AES-256-GCM-SHA384 option has been removed by an administrator. Under config vpn ssl settings, the ciphersuite setting has been modified from the default. By comparison, tunnel-mode connections work fine on Windows 10. SSL-VPN tunnel-mode connections via FortiClient fail at 48% on Windows 11, citing the following error: 'Credential or SSLVPN configuration is wrong (-7200)'. Packet captures indicate that the TLS connection between FortiGate and FortiClient is established, yet SSL-VPN connections fail regardless. SSL-VPN web-mode is working correctly for both Windows 10 and Windows 11.

The following symptoms/situational-behaviors are associated with this problem: This article describes a potential cause for why SSL-VPN connections may fail on Windows 11 yet work correctly on Windows 10.

Forticlient vpn windows 10