Technical Tip: How to enable EAP-TTLS for IPSec IKEv2 tunnels in VPN-only (unlicensed) FortiClient

Description

This article describes how to enable EAP-TTLS as an authentication method in VPN-only (unlicensed) FortiClients.

Scope

FortiClient, EAP-TTLS authentication for IPsec VPN.

Solution

1. EAP-TTLS Support in FortiClient.

FortiClient added support for EAP-TTLS authentication for IPsec VPN starting with version 7.4.3. This authentication method must be used when users need to authenticate to a remote LDAP server while connecting to an IPsec IKEv2 tunnel.

2. FortiToken Compatibility.

Support for FortiToken with EAP-TTLS was introduced in FortiClient version 7.4.4. If FortiToken authentication is enabled, the free FortiClient version 7.4.3 will be unable to connect, as this version does not support multi-factor authentication with EAP-TTLS.

The following are the required firmware versions. Refer to Technical Tip: Multi-Factor Authentication support for Windows FortiClient with LDAP (EAP-TTLS).

EAP-TTLS MFA support requires the following minimum firmware versions:

• FortiOS v7.4.9, v7.6.1.

• FortiClient Windows v7.4.4. Note that the VPN-only free version of FortiClient Windows does not have a v7.4.4 release; see Special notices.
   

3. Enabling EAP-TTLS.

1. EMS-managed FortiClients.

FortiClient documentation outlines how to enable EAP-TTLS support for EMS-managed FortiClients here:

EAP-TTLS support for IPsec VPN

2. Unlicensed FortiClients.

For unlicensed FortiClients, EAP-TTLS must be enabled by manually editing the FortiClient configuration file, which requires some familiarity with XML configuration.

4. Prerequisites.

Before enabling EAP-TTLS, an IPsec IKEv2 tunnel should first be configured in FortiClient to match a dial-up configuration on the FortiGate.

Examples of configuration guides for IPsec IKEv2 dial-up tunnels include:

• Technical Tip: FortiGate IPsec dial-up IKEv2 SAML-based authentication with FortiAuthenticator as IdP

• Technical Tip: IKEv2 dialup IPsec tunnel with RADIUS server authentication and FortiClient

Once a VPN tunnel is configured on FortiClient, it can be edited to enable EAP-TTLS support.

1. Export a FortiClient configuration backup.
   
   

2. Edit the resulting *.conf file in an Editor like Wordpad, Notepad++, or similar.
   
   

3. Find the section:
   
   

<vpn>
    <ipsecvpn>
         <connections>
             <connection>

There should be a connection listed with the name of the configured IPsec tunnel within this connection. Find the <ike_setting> part.

4. In <ike_settings>, add the following line:
   
   

<eap_method>2</eap_method>

Using 1: requires EAP-MSCHAPv2 authentication.
Using 2: requires EAP-TTLS/PAP authentication.

5. Save the modified configuration as a separate file.
   
   

6. Import the modified configuration into FortiClient. This may require the FortiClient to be unlocked.

Important note:

At the time of writing, FortiClient iOS and Android do not support EAP-TTLS/PAP authentication.

EAP Method not saved in configuration backup:

Although the EAP method can be introduced by restoring a modified backup, FortiClient v7.4 does not save the EAP Method value in the configuration backup. If a FortiClient backup is taken from a FortiClient with EAP-TTLS enabled and restored to a different FortiClient without modification, the new FortiClient will not have EAP-TTLS enabled.

Verifying the EAP method via the registry editor:

The current EAP method for a tunnel can be viewed in the Registry Editor by navigating to 'HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FortiClient\IPSEC\Tunnels\<TunnelName>\P1\eap_method'.

• If the eap_method value is 1, the tunnel uses EAP-MSCHAPv2.

• If the eap_method value is 2, the tunnel uses EAP-TTLS.

Related documents:

• Technical Tip: How to resolve the 'EAP authentication failed due to missing token' error when using EAP-TTLS /PAP + 2FA Authentication

• Technical Tip: Multi-Factor Authentication support for Windows FortiClient with LDAP (EAP-TTLS)

• EAP-TTLS support for IPsec VPN

• Troubleshooting Tip: EAP-TTLS connection failing with FortiClient and IPsec IKEv2 connection due to certificate error