Troubleshooting Tip: IPsec remote VPN authentication does not work with TACACS+

Description

This article describes a technical solution to the issue where IPsec Remote VPN authentication does not work with TACACS+ on FortiGate devices. The user is unable to authenticate using TACACS+ groups, while local user groups work as expected.

Scope

FortiGate.

Solution

TACACS+ is not officially supported as a user authentication method for IPsec VPN with either IKEv1 or IKEv2.

The supported user authentication methods for IPsec VPN are as follows:

For tunnel authentication, the following methods are supported with both IKEv1 and IKEv2:

• Pre-shared Key (PSK).

• PKI (Signature).

The TACACS+ protocol is primarily designed for authenticating, authorizing, and accounting for administrative access to network devices. It is not designed to support more complex user-access use cases such as IPsec VPN user authentication.

IPsec VPN authentication may require additional user and group-related information for authorization and access control. TACACS+ does not natively provide the required group attributes for this purpose. RADIUS and LDAP are generally preferred for VPN user authentication because they provide better support for user and group attributes.

IKEv1 uses XAuth for user authentication, while IKEv2 uses EAP for user authentication. Therefore, if centralized authentication is required for Remote Access IPsec VPN users, RADIUS or LDAP should be used as the supported alternatives. SAML can also be used with IKEv2.

Starting from FortiClient v7.4.3 and onward, EAP-TTLS authentication is supported with IKEv2 and can be used with LDAP authentication: EAP-TTLS support for IPsec VPN v7.4.3.

Note:

A FortiClient EMS subscription is also required to enable the EAP method in the XML config of the IPsec tunnel on FortiClient EMS.


The required EAP method can also be enabled by taking a configuration backup of the VPN-only unlicensed FortiClient, editing it, and restoring it as outlined here: Technical Tip: How to enable EAP-TTLS for IPSec IKEv2 tunnels in VPN-only (unlicensed) FortiClient.

For more information about the supported authentication methods, refer to the following Fortinet documentation: Authentication Method.