Skip to main content
damianhlozano
damianhlozano
Explorer II
October 30, 2024
Question

Active Directory users on IPsec VPNs with 2FA

  • October 30, 2024
  • 4 replies
  • 2868 views

Hello team!

 

Is there a way to create VPN ipsec which could use domain users (AD) and use 2FA for each user?

In this case, is there a way to use 2FA through email?

I think, to configure a different 2FA for each user, these users should be in Fortigate, but I ask just in case that there is anything else that I cant see.

If not, do you know any other VPN which would allow this? 

Is this possible with ZTNA? (I am still very noob with ZTNA), in this case I will need to learn more

 

Thanks in advance.

Regards,

Damián

 

4 replies

AnthonyH
Staff
AnthonyH
Staff
October 30, 2024

Hello damianhlozano,

I do not believe I done this, but you can try:
1) Creating the IPsec Dialup VPN.
2) Configure the FortiGate and connect it to your LDAP server. https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-FortiGate-to-use-an-LDAP-server/ta-p/196141
3) Configure the user for 2FA in CLI: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Email-Two-Factor-Authentication-on-FortiGate/ta-p/194890

 

    vbandha
    Staff
    vbandha
    Staff
    October 30, 2024

    Hi @damianhlozano ,

     

    Regarding your query "I think, to configure a different 2FA for each user, these users should be in Fortigate, but I ask just in case that there is anything else that I cant see."

     

    Well they are not strictly in fortigate. What I mean is you don't need to create local user, you can create a ldap user. You are still creating individual user but the authentication happens with ldap:

    Here is an article related to that:

    https://community.fortinet.com/t5/FortiGate/Technical-Note-Configuring-Remote-LDAP-users-with-Two-Factor/ta-p/189633

     

    You can create the ldap user and then follow same steps to configure 2fa with email like local user:

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-Email-Two-Factor-Authentication-on-FortiGate/ta-p/194890

     

    Regards,

    Varun

      damianhlozano
      damianhlozanoAuthor
      Explorer II
      October 31, 2024

      Thank you vbandha and AnthonyH!

      Now I know how to create IPsec DialUp VPN with LDAP authentication and 2FA

      Anyway, I should have remote ldap users in the Fortigate, and if some user is added to AD, should be added to the Fortigate to.

       

      Is there a way to apply the 2FA to AD and make Fortigate to know this?

      I mean, if Fortigate does not know that AD has 2FA, FortiClient will never ask for the 2FA code.

       

      ¿Do you know if is this possible with ZTNA?

       

      Thanks

      Regards,

      Damián

      pminarik
      Staff
      pminarik
      Staff
      October 31, 2024

      If you're using the template/wizard dialup IPsec for remote FortiClients, this will be IKEv1 with XAUTH. 2FA is easy with this, it will be just two XAUTH exchanges (password, then OTP) during mode-config exchange after phase1 is established.

      This can be done with remote LDAP server, and individual users imported into the FortiGate with FortiTokens individually assigned to them. For a solution more manageable at scale, you would want either FortiAuthenticator (to manage & (auto-)assign the tokens to users), or FortiToken-Cloud (can do automated token assigment to an entire OU in the LDAP tree).

        damianhlozano
        damianhlozanoAuthor
        Explorer II
        November 1, 2024

        Thanks pminarik,

        I will try this the next week.

         

        Regards,

        Damián

        damianhlozano
        damianhlozanoAuthor
        Explorer II
        November 15, 2024

        Thanks a lot, pminarik!!

         

        Now, the last question, sorry.

        Is this possible with ZTNA VPNs:

        * Group of AD/Azure users, can connect to VPN

        * Users have 2FA

        * User are only in AD/Azure, no need to add all users locally on Fortigate or FortiClient EMS

         

        Thanks.

        Regards!

        Damián

        pminarik
        Staff
        pminarik
        Staff
        November 15, 2024

        The ZTNA-license-type for EMS/FortiClient is enough for any VPN functionality.

        ZTNA-based conditional access for VPN users is optional, and available.

         

        If Azure/Entra is avaliable, that may be an interesting option. You could use SAML for authentication, and handle 2FA on the IdP (Azure side). The FortiGate will then only need some group definitions, no user importing or 2FA assignment there.

        For on-prem AD (~LDAP, or RADIUS), you would need to decide where you want the 2FA assignments done and provisioned to users. (FortiAuthenticator, FTK-Cloud are options as mentioned already; or any 3rd party that can do something similar)

        Terms & ConditionsAccessibility statement