Technical Tip: User source detection for PKI based IPsec users

Description

This article describes the behavior of how the user source is detected and handled in PKI authentication when using IPsec VPN.

Scope

FortiGate.

Solution

In SSL VPN, when a PKI user authenticates, the Forward traffic logs show the user source and the related certificate details, such as the 'cn', and this behavior is different in IPsec Vpn as explained below.

In IPsec VPN, when authenticating a PKI user, the Forward traffic logs do not show the certificate information in the logs, and this is expected behavior. The information is visible in the VPN event logs and IPsec monitor page in the GUI, where the user 'cn' information and assigned IP address are observed.

• Navigate to Log & Report and select VPN event logs:

CN information:

Assigned IP:

• On IPsec monitor:

• On the command line, execute the command below to view the certificate details:

diagnose vpn ike gateway list

As mentioned, the certificate information will not be seen in the Forward traffic logs, and this is expected behavior.