Skip to main content
chefedinga
Staff
chefedinga
Staff
July 3, 2026

Technical Tip: Requirements for IKEv2 Dial-up IPsec VPN with Certificate and LDAP Authentication

  • July 3, 2026
  • 0 replies
  • 186 views

Description

This article describes the requirements and recommendations for configuring dial-up IPsec IKEv2 VPN using certificate authentication combined with LDAP authentication on FortiGate.

Scope

FortiGate, FortiClient, LDAP, Active Directory, IKEv2 IPsec VPN.

Solution

When configuring Dial-up IPsec VPN with IKEv2 using certificate authentication and LDAP authentication, ensure the following requirements are met:

  • FortiClient version:

Use FortiClient version 7.4.3 or later.

Using the latest recommended FortiClient release compatible with the target FortiOS version is strongly recommended to avoid interoperability or authentication issues.

  • LDAP / Active Directory requirements:

For this deployment scenario, FortiGate uses EAP-TTLS for IKEv2 user authentication against LDAP backends.

Ensure the LDAP or Active Directory infrastructure supports the required authentication and user attribute lookup methods.

  • Certificate requirements:

The client certificate must meet the following requirements:

  1. The certificate must contain a valid and complete certificate chain.

  2. The issuing CA certificate must be imported and trusted on the FortiGate.

  3. The certificate should include the proper Extended Key Usage (EKU), typically:

    • Client Authentication.

  4. The certificate identity should use one of the following fields:

    • Common Name (CN).

    • Subject Alternative Name (SAN) with User Principal Name (UPN).

The selected certificate field must match the LDAP user attribute configured on the FortiGate. Examples include:

  • SAN UPN mapped to userPrincipalName.

  • CN mapped to sAMAccountName or CN.

  • FortiOS version recommendation:

Use the latest stable FortiOS release recommended by Fortinet to benefit from the latest bug fixes, security updates, compatibility improvements, and feature enhancements, and upgrading to a currently supported FortiOS release is strongly recommended.


Related documents:

Technical Tip: Certificate authentication for ikev2 VPN with Radius or LDAP user authentication

    Terms & ConditionsAccessibility statement