Technical Tip: SSL VPN portal is not editable

[gmarcuccetti]

Description
While trying to edit a SSL VPN portal from GUI, error 'Input value is invalid' is appearing.

This article describes how to fix it.

Solution
If 'keep-alive' is enabled but 'save-password' is disabled, the portal is not editable.

From CLI.

name                : tunnel-access
tunnel-mode         : enable
ipv6-tunnel-mode    : enable
web-mode            : disable
host-check          : none
limit-user-logins   : disable
mac-addr-check      : disable
os-check            : disable
forticlient-download: enable
ip-mode             : range
auto-connect        : disable
keep-alive          : enable
save-password       : disable

If any change from CLI are done, a similar error will appear

save-password should be enabled as either auto-connect or keep-alive is enabled.
object check operator error, -651, discard the setting
Command fail. Return code 1

The same behaviour will appear if 'auto-connect' is enabled but 'save-password' disabled.

For the tunnel mode logic it is necessary to have a saved password in order to use keep-alive or auto-connect.

To clear the error you have to enable 'save-password' or disable 'keep-alive' / 'auto-connect'.

From GUI.

From CLI.

# config vpn ssl web portal
    edit "tunnel-access"
        set tunnel-mode enable
        set ipv6-tunnel-mode enable
        set keep-alive enable
        set save-password enable
    next
end

Related article.
https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/0a3c2929-1a13-11e9-9685-f8bc12...