Skip to main content
Navs1818
Navs1818
New Member
May 15, 2024
Question

2FA SSL VPN with LDAP authentication

  • May 15, 2024
  • 5 replies
  • 3366 views

Hi all, i have a HA (active passive) pair of 100E fortigate firewalls and want to enable 2FA for SSL VPN.

 

Current Setup

We use LDAP auth, with any users in a specific AD group allowed to VPN in, saves us having to create individual users on the firewall.

 

2FA Setup

Two me it appears i can use either Fortitokens or a Certificate for 2FA, but from reading and testing it appears that for both methods i need to create local users mapped to LDAP users on the firewall. Then i can either apply a token or a cert to each user (LDAP or PKI), is my understanding correct?

 

Is there any way to enable 2FA without the need to create individual users on the firewall?

 

Thanks

5 replies

sw2090
SuperUser
sw2090
SuperUser
May 15, 2024

afair the Fortigates do support radius usergroups so you don't need to create the users here. Alas in this case the 2FA has to be done by the radius. We do it this way with IPSec VPN using a FortiAuthenticator for radius auth on it using radius usergroups from the FAC which are filled with users the FAC imports from AD Usergroups. FAC also provides FortiTokens as 2FA here.

    Navs1818
    Navs1818Author
    New Member
    May 15, 2024

    Unfortunately, we don't use a FAC. I assume there is no way to sync LDAP users belonging to a specific AD group into the fortigate itself?

    sw2090
    SuperUser
    sw2090
    SuperUser
    May 15, 2024

    hm I assume that then you will need to use the FGT's AD Connector for authenticating against AD. 2FA then might force you to create radius users on the FGT to be able to add a cert or token to the user.

      hbac
      Staff
      hbac
      Staff
      May 15, 2024

      Hi @Navs1818,

       

      Yes, you need to create each local user otherwise, you won't be able to assign FortiToken to each user. You can consider using SAML or DUO MFA.

       

      Regards, 

        Navs1818
        Navs1818Author
        New Member
        June 13, 2024

        Hi, I looked into SAML with M365 and this looks like the best option, no need to pay extra for tokens and can use Azure groups to manage access. One question though.

         

        If i add the SAML configuration alongside my current SSL VPN config which is based on LDAP user groups, will the current SSL VPN break or can the two run alongside each other whilst i test? i can't see why they couldn't run alongside each i want to check first.

         

         

        pminarik
        Staff
        pminarik
        Staff
        June 13, 2024

        SAML and non-SAML (LDAP, RADIUS, ...) use different auth-flows, so they should not compete and cause breakage like LDAP vs RADIUS potentially can.

         

        The only tricky part to watch out for is if you're using source-interface/-address restrictions in portal mappings (user/group -> portalX), make sure to apply those to the new SAML mappings as well (CLI only: config vpn ssl setting -> config authentication-rule).

        Navs1818
        Navs1818Author
        New Member
        May 15, 2024

        Looks like the other option is to use Forticloud tokens, you can sync users in a particular AD group into forticloud and it will then assign a token, but it has an annual cost.

        Terms & ConditionsAccessibility statement