dial up tunnel 2FA for linux clients

Forum|Forum|1 year ago
April 30, 2025
9 replies
2667 views

i'm trying to migrate from SSL vpn to IPsec remote access tunnel. Im using IKEv1 but the linux forticlient doesn't support IPsec. so I tried alternatives like Strongswan and Libreswan and i was able to connect to the tunnel. the users should have two step verification (i'm using email code) on but the problem is when the two step verification gets on i'm not able to connect to the tunnel anymore and it won't prompt for code. Is there anything i can do or any alternatives i could use to be able to connect when 2FA is on.

funkylicious

SuperUser

hi,

try appending the token inside the xauth password configuration, like : passwordTOKEN

https://unix.stackexchange.com/questions/678751/ipsec-psk-vpn-with-strongswan-to-fortigate-with-one-time-passwordfortitoken

L.E. I just saw that your token code is via email ... which means that you don't know/have it before connecting so this might not work in your case.

"jack of all trades, master of none"

iamirreza13Author

Explorer II

hi,

thanks for your reply. yes i'm getting the token code via email and this won't help since the code will be send to email after the tunnel goes up. is there any other possible solution that can help me?

AEK

SuperUser

I don't know if strongSwan supports 2 step authentication or challenge-response (password then TOKEN), but I think funkylicious suggestion is correct if you have FortiAuthenticator or RADIUS authentication. In that case RADIUS server usually accepts concatenated 2FA auth ("passwordTOKEN")

However if the users is stored on FGT then I don't think there is a possibility of one step "passwordTOKEN".

Your solution is probably to use a RADIUS server or FAC.

AEK

iamirreza13Author

Explorer II

hi,

thank you very much for the insight. im using LDAP for users authentication and the code gets send after i enter the password and if the password is right. after that strongswan or any alternative that I've tested doesn't have an option to prompt for the code. if I use RADIUS does it make a difference? and I don't have access to fortitokens that's why i use the email token as 2fa

AEK

SuperUser

Hi

Are you using FreeIPA as LDAP? In that case you may not need to switch to RADIUS.

In FreeIPA you can assign an OTP Token to a user, in that case the token can be FortiToken, MS Authenticator, Google Authenticator, Red Hat's FreeOTP. I tested all of them with FreeIPA and all worked fine. I also guess any other should work.

For my test I configured my FortiGate to authenticate from the IP server and in that case the passwordTOKEN concatenation worked just fine.

AEK