Troubleshooting Tip: Token prompt not received for IPsec dial up VPN and EAP password failure error received
| Description | This article describes a use case where, after enabling IKEv2, the user authentication fails with the error 'EAP password failure'. |
| Scope | FortiGate, FortiAuthenticator. |
| Solution | In this use case, the setup works as expected with PAP using IKEv1. However, in IKEv2, MS-CHAPv2 will be used.
Debugs to be checked: FortiClient debug: Log Level -> Debug.
IPsec debug from FortiGate:
diagnose debug console timestamp enable diagnose vpn ike log filter rem-addr4 <remote_side_publicIP>
To disable the debug after testing:
diagnose debug disable
FortiAuthenticator debug:
https://<FAC IP>/debug/radius/
For detailed debug logs, it is better to use https://<FAC IP>/debug/. Navigate to Log Category -> RADIUS to see Authentication, Accounting, Accounting monitors logs.
From FortiAuthenticator debug, it can be observed that a challenge message is sent, but no response is received. In the user PC, an EAP password error is received.
2026-01-02T03:47:22.824653-08:00 FortiAuthenticator radiusd[30624]: (4) eap: EAP session adding &reply:State = 0x22a6ecd322a7eaff
Solution: Step 1: Ensure EAP is enabled in the RADIUS policy:
In the RADIUS policy, under Advanced Options, enable 'Allow OTP for EAP-MSCHAPv2 Authentication with FortiClient'.
Step 2: Configure it using the <eap_method> option in the FortiClient's XML configuration: In <ike_settings>, add the following line:
Using 1, authentication is performed using EAP-MSCHAPv2.
Note: Verify that the FortiAuthenticator domain join is successful. If successful, the connection should show as 'joined domain, connected' under Monitor -> Authentication -> Windows AD. Additionally, in the RADIUS Policy under Authentication -> RADIUS Service -> Policies -> Identity Sources, verify that the option 'Use Windows AD Domain Authentication' is enabled.
Related documents: |
