Could not authenticate to gateway (Bad HTTP response code)

[HtwoO]

The other day I was trying to connect to my SSLVPN gateway on Huawei USG6620. I got an error saying "ERROR: Could not authenticate to gateway (Bad HTTP response code)." Below are more detailed log and the process I used to setup the VPN.

On client side, I built openfortivpn-1.7.1, to be used on Debian Stretch.

I put the self-signed CA swan.crt in /usr/local/share/ca-certificates/swan/
and then ran update-ca-certificates

Then I ran openfortivpn to connect to the gateway.

sudo openfortivpn vpn-gateway:443 --username=cat1 --cipher-list=AES256-SHA256 --trusted-cert (censored-fingerprint) -v

WARN: Bad port in config file: "0".
DEBUG: Loaded config file "/etc/openfortivpn/config".
VPN account password:
DEBUG: Config host = "censored.gateway.net"
DEBUG: Config realm = ""
DEBUG: Config port = "443"
DEBUG: Config username = "cat1"
DEBUG: Config password = "********"
DEBUG: server_addr: censored.gateway.ip
DEBUG: server_port: 443
DEBUG: gateway_addr: censored.gateway.ip
DEBUG: gateway_port: 443
DEBUG: Gateway certificate validation succeeded.
INFO: Connected to gateway.
ERROR: Could not authenticate to gateway (Bad HTTP response code).
INFO: Closed connection to gateway.
DEBUG: server_addr: censored.gateway.ip
DEBUG: server_port: 443
DEBUG: gateway_addr: censored.gateway.ip
DEBUG: gateway_port: 443
DEBUG: Gateway certificate validation succeeded.
INFO: Logged out.

Gateway setting on Huawei USG6620

v-gateway public ssl version tlsv11 tlsv12
v-gateway public ssl ciphersuit custom aes256-sha non-des-cbc3-sha aes128-sha
v-gateway public certificate-server gw_local.cer enable
v-gateway ssl interface GigabitEthernet1/0/3 private censored.gateway.net
v-gateway ssl alias ssl

#****BEGIN***ssl**1****# (Just prevent being enterpreted wrongly)

v-gateway ssl
basic
...
ssl ciphersuit custom aes256-sha non-des-cbc3-sha aes128-sha
certificate-server gw_local.cer enable
certificate-ca certificate-file dr.cat1.crt.pem enable
...
security
policy-default-action permit vt-src-ip
certification cert-anonymous cert-field user-filter subject cn group-filter subject cn
certification cert-anonymous filter-policy permit-all
certification cert-challenge cert-field user-filter subject cn
certification user-cert-filter key-usage any
public-user enable
public-user default-login-number 100

On the web management panel of the Gateway. Under Network -> "SSL VPN" -> "SSL VPN", in the SSLVPN profile, in "Gateway Configuration" -> "User Authentication" part, the setting is like the following.

"Local Certificate", I chose certificate for the gateway here;
"Client CA Certificate", I uploaded the certificate fot the client I was testing;
"Certificate Authentication", I tried between "None", "Anonymous Certificate" and "Certificate Challenge"; Then I chose all default option for all the remaining options under "User Authentication" part.

The USG6620 is running V500R001C60SPC300 firmware, if that helps.

Any ideas?

[DimitriPapadopoulos]

All I can say at this point is that the error message is printed after function auth_log_in() fails:
https://github.com/adrienverge/openfortivpn/blob/2aca389/src/tunnel.c#L792-L795
and auth_log_in() fails with ERR_HTTP_BAD_RES_CODE here:
https://github.com/adrienverge/openfortivpn/blob/2aca389/src/http.c#L562-L56563
because the gateway sends a response different from HTTP/1.1 200 OK. Don't know the exact HTTP error code because we do not currently provide detailed enough error messages (that's a reason why I suggest using a 3rd party library in #347).

Perhaps Huwaei gateways are different from Fortinet gateways. Unfortunately I'm not familiar enough with either Fortinet or Huawei devices. Do the gateway logs provide more info?

[mrbaseman]

@HtwoO , openfortivpn is an ssl vpn client for connecting to Fortigate appliances. I'm not sure if Huawei appliances behave exactly the same way as the ones from Fortinet do.

[HtwoO]

Thank you for your response. I will look deeper into it.

[nixx-geek]

Did you solve this? I have the same issue with a Fortinet gateway.

[turbomettwurst]

I just ran into this, running the official client yielded a better error message: "NOTICE::Insufficient credential(s). Please check the password, client certificate, etc."

Now that the credentials are corrected openfortivpn works just fine.
So in doubt, try the official client. It is shit, but its error messages are better (for now)

[DimitriPapadopoulos]

@Claudiuion @turbomettwurst You're connecting to a Fortinet appliance, aren't you? This ticket is about Huawei appliances.

[DimitriPapadopoulos]

@HtwoO Have you found whether Huawei appliances are supposed to function like Fortigate appliances? Are you able to connect to Huawei appliances using Fortinet's FortiClient software? If not, I suggest we close this ticket.

[nixx-geek]

@Claudiuion @turbomettwurst You're connecting to a Fortinet appliance, aren't you? This ticket is about Huawei appliances.

Yes, @DimitriPapadopoulos , you are right

[DimitriPapadopoulos]

@turbomettwurst I agree the Bad HTTP response error message is imprecise and not helpful. It covers any HTTP response different from 200. I've tried to fix the most common error in #389, but we really need to switch to a lightweight 3rd party HTTP library or improve http.c.

[turbomettwurst]

Sorry for the mess :-)
To clarify: i totally ignored any information that said huawei.
The case i was taking about was an actual fortinet device. Specifically one running FortiOS 5.6.x

[DimitriPapadopoulos]

@turbomettwurst If you still reproduce this problem, please do not hesitate to open a new ticket. Be aware though that such issues are usually (perhaps always?) related to authentication failures: wrong password, wrong certificate, blacklisted after too many errors, parallel VPN sessions, etc.

[HtwoO]

@HtwoO Have you found whether Huawei appliances are supposed to function like Fortigate appliances? Are you able to connect to Huawei appliances using Fortinet's FortiClient software? If not, I suggest we close this ticket.

No. I ended up using L2TP over IPSec.

[DimitriPapadopoulos]

Thank you for the feedback.

[mrbaseman]

for the ones who were following here: In 1.8.0 we have improved the debugging output. The http response code is printed out in debugging mode (when launched with -v option), and starting with this release the complete http traffic for the authentication process is shown when the option is used twice. This can help debugging authentication problems, and might also give hints about the behavior of other appliances when trying to connect via openfortivpn

[bernd-wechner]

Great, now how do I get 1.8.0 ;-). I have 1.60 from the Mint repos. Will do some reading. A PPA perhaps?

[bernd-wechner]

All good found a build here. Useful to know:

https://pkgs.org/download/openfortivpn

Might pay to put that link in the README.

[DimitriPapadopoulos]

These are for ubuntu 20.04. I don't know how compatible they are with Mint.

In any case such questions should be asked in Mint forums, we don't maintain vendor packages here.

[bernd-wechner]

Well, the 1.12 package works fine. But I'd have thought if you're mentioning a 1.8 feature you'd know how to get 1.8. Even if that happened to involve building form source, but that would not have struck me as a first supposition as I sort of expect a major release (1.6, 1.7, 1.8 ...) comes packaged somehow for some systems at least.

[DimitriPapadopoulos]

We don't package for specific distributions, we just maintain the sources. Building from sources is explained in the very first page of the project:
https://github.com/adrienverge/openfortivpn
Source tarballs are available under releases as usual in GitHub.

In any case this is unrelated to this issue, which is closed. If needed, please open a new issue.

Generally speaking, for issues related to vendor packages and available versions in packages, you need to talk to packagers of the distribution you're interested in. On Linux open source software usually works like this.: talk to maintainers about source code and to packagers about packages. We could do both of course but we just don't have time for that. Mint Linux forums are here:
https://forums.linuxmint.com/
It looks like Mint Linux re-uses packages from Ubuntu and overrides only a few of them:
http://packages.linuxmint.com/list.php?release=Ulyana
In that case the above Ubuntu packages should be compatible with Mint Linux.

[bernd-wechner]

No worries, as I said this:

https://pkgs.org/download/openfortivpn

Is a great resource and solved the problem for me. The Ubuntu 20.04 package is fine. Always a small gamble depending entirely on all the dependencies that a given package has, but if they are few or none (the package is well self contained) no problems taking a package from an upstream version of Ubuntu or even Debian usually ... and that website is one dandy resource!