Troubleshooting Tip : FortiClient error 'Credential or SSL VPN configuration is wrong. (-7200)' after upgrading to v7.6.3

[nevan]

Description	This article will describe the troubleshooting tip for the scenario where the admins upgrade to v7.6.3 and later find the FortiClient error 'Credential or SSLVPN configuration is wrong. (-7200)'.
Scope	FortiGate v7.6.3, FortiClient.
Solution	The FortiClient error 'Credential or SSL VPN configuration is wrong. (-7200)' has been described in the following KB article: Troubleshooting Tip: When logging in with SSL VPN, the error 'Credential or SSLVPN configuration is... However, if after upgrading to v7.6.3, the SSL VPN stops working, the error 'Credential or SSLVPN configuration is wrong. (-7200)' appears and not resolving with the workaround from the above KB article, it is suggested to check if the portals used in SSL VPN settings have 'tunnel mode' disabled or not. If, after the upgrade, the tunnel modes are suddenly disabled, this incident can be observed: The debug can share the invalid credential error as follows: [341:root:435]fam_auth_send_req:1003 task finished with 4 [341:root:435]fam_auth_proc_resp:1358 fnbam_auth_update_result return: 1 (invalue username/password) [341:root:435][fam_auth_proc_resp:1496] Authenticated groups (7) by FNBAM with auth_type (16): [341:root:435]Received: auth_rsp_data.grp_list[6] = 532818560 [341:root:435]login_failed:497 user[evega],auth_type=16 failed [sslvpn_login_permission_denied] [341:root:435]sslConnGotoNextState:325 error (last state: 1, closeOp: 0) [341:root:435]Destroy sconn 0x7fdc4e4e2600, connSize=0. (root) [341:root:435]SSL state:warning close notify (179.60.146.37) For the users with SAML authentication it will be observed that after creating the service provider login response '__samld_sp_login_resp' an immediate logout request is appearing '__samld_sp_create_logout_req' as it could not find the tunnel in the assigned portal. </Session> *********************** __samld_sp_login_resp [882]: **** SP Login Dump **** SP Session Dump <saml:NameID xmlns:saml="urn:ois:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"> </NidAndSessionIndex> </Session> __samld_sp_create_logout_req [988]: **** SP Logout request **** </samlp:LogoutRequest> *********************** After enabling the tunnel mode, it is requested to select the correct IPPOOL to bring the tunnel into operational mode again. Related article: Technical Tip: Credential or SSL-VPN configuration is wrong (-7200) Radius user