Technical Tip: Dial-up IPsec VPN users with security certificates (authentication method)

Description

This article describes all the needed configuration and how to create the certificates using OpenSSL to set up dial-up IPsec VPN users with security certificates as an authentication method.

Scope

Download the OpenSSL software. In this case, it was downloaded on a Windows PC.
Generate in the openSSL the CA certificate (crt) with the commands below:

C:\OpenSSL-Win64\bin>openssl genrsa -des3 -out ca.key 4096
C:\OpenSSL-Win64\bin>openssl req -new -x509 -days 365 -key ca.key -out ca.crt

Generate Server Certificate. Create a CSR in the FortiGate and download it to be signed through the OpenSSL software using the following command:

C:\OpenSSL-Win64\bin>openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out ipsecdialup.crt

Generate a client certificate through the following list of commands:

C:\OpenSSL-Win64\bin>openssl genrsa -des3 -out client.key 4096
C:\OpenSSL-Win64\bin>openssl req -new -key client.key -out client.csr
C:\OpenSSL-Win64\bin>openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt
C:\OpenSSL-Win64\bin>openssl pkcs12 -export -in client.crt -inkey client.key -certfile ca.crt -name "test" -out client.p12

Note:

After entering the command 'openssl.exe req ...', it might show the error 'No such file or directory' in the console. It is possible to fix it by input command: 

set OPENSSL_CONF=[path-to-OpenSSL-install-dir]\bin\openssl.cnf 

For example:

Solution

Import the CA certificate and Server Certificate to the FortiGate:
Go to System -> Certificates -> Import -> Local Certificate and select the server certificate.
Go to System -> Certificates -> Import -> CA Certificate and select the CA certificate.

Configure user peer and peergrp:

config user peer
    edit test1
        set ca ""                 <----- Specify the CA certificate already uploaded.
end

config user peergrp
    edit user_group1
        set member test1
end

Set up IPsec VPN dial-up:

IKEv1:
Check, if needed, to enable NAT traversal. In this case, it is not required.

 

Specify the server certificate and peergrp as follows:

 

 

At last, specify the user group for XAUTH:

 

 

 

IKEv2:

 

 

 

For the firewall policy, no user group is needed as the authentication is handled through the certificate itself :

 

 

 

Import the CA certificate and the client certificate (.p12 format, including the private key) to the user's side. After that, verify the import in MMC -> Certificate (current user):

• The CA certificate should be presented on Trusted Root Certification Authorities -> Certificates.
• The user certificate should be presented on Personal -> Certificate.

 

 

Finally, select the authentication method in FortiClient to use the X. 509 certificate that was previously uploaded.

For example:

 

 

As a result, it could connect successfully:

 

 

Verification: