A remote user reports slow SSL VPN performance and frequent disconnections. The user is located in an area with poor internet connectivity. What…

FortiGate SSL VPN can use DTLS (Datagram Transport Layer Security) over UDP to improve performance. However, DTLS is sensitive to network conditions like high latency and packet loss, which are characteristic of "poor internet connectivity." When DTLS packets are delayed, the connection may time out and attempt to re-establish or fall back to TLS over TCP, causing performance degradation and perceived disconnections. By increasing the DTLS timeout value, the FortiGate will wait longer for responses, making the VPN tunnel more resilient to high-latency connections and reducing the frequency of disconnections for users on unstable networks.

A. Enable split tunneling to reduce VPN traffic.

This reduces the volume of traffic over the VPN, which can improve performance by saving bandwidth, but it does not directly address connection instability caused by high latency or packet loss.

B. Change the SSL VPN port to a non-standard port.

This is a technique to bypass port-blocking or throttling by an ISP or local network firewall. It does not improve the VPN's tolerance to poor network quality like high latency.

C. Increase the session timeout for inactive sessions.

This setting (idle-timeout) applies to sessions with no activity. The user is actively using the VPN and experiencing disconnections, so this setting is not relevant to the problem.

1. FortiOS 7.6.0 CLI Reference:

Under the config vpn ssl settings command context

the dtls-hello-timeout option is described. The purpose of this timer is to manage the initial DTLS handshake. The documentation notes its range and default value

and adjusting it is a standard procedure for accommodating slow or high-latency networks. (See config vpn ssl settings section).

2. FortiOS 7.6.0 Administration Guide:

In the "SSL VPN" chapter

the guide discusses the use of DTLS for tunneling. It explains that DTLS runs over UDP for better performance but can be impacted by unreliable networks. The guide implicitly supports tuning related parameters to stabilize connections in such environments. (See "SSL VPN best practices" and "Troubleshooting" sections).