Skip to main content
Subhojit_Dutta
Subhojit_Dutta
New Member
March 12, 2026
Question

Fortigate IPsec Dialup VPN Multiple User Group

  • March 12, 2026
  • 4 replies
  • 1355 views

Hi everyone,

I am configuring a Dial-up IPsec VPN on FortiGate (FortiOS 7.6.6) and I want to restrict access based on the user group.

Requirement

I have two local user groups configured on the FortiGate

         RA-ADMIN-USER

         RA-CCTV-USER

Both groups should be able to connect to the same Dial-up IPsec VPN tunnel, but with different access permissions

         RA-CCTV-USER → should be able to access only the CCTV subnet 

         RA-ADMIN-USER → should be able to access all internal subnets

 

What is the recommended way to allow multiple user groups to authenticate to the same IPsec Dial-up VPN?

 

If anyone has implemented a similar setup, I would appreciate guidance or example configuration.


Thanks in advance.

4 replies

ede_pfau
SuperUser
ede_pfau
SuperUser
March 12, 2026

In principle, you have 2 options:

1- put the usergroup into phase1

2- leave phase1 alone and put usergroups into the policies needed.

 

Absolutely recommend option 2. For authenticating the VPN itself, use a PSK or a cert.

Subhojit_Dutta
Subhojit_DuttaAuthor
New Member
March 12, 2026

Hi Ede,

I am using IKEv2 with PSK for Phase 1 authentication.

I tried using the "Inherit from policy" option and configured the user groups in the firewall policies, but for some reason the VPN connection is not successful.

Am I missing something in the configuration?

Any guidance would be appreciated.

Thanks.

ede_pfau
SuperUser
ede_pfau
SuperUser
March 12, 2026

This is the way. You can set up some diags to see what happens at login:

diag debug enable

diag debug app ike -1

 

to stop:

diag debug app ike 0

(you can type that into the output stream...)

 

jintrah_FTNT
Staff
jintrah_FTNT
Staff
September 30, 2022

Hi,

 

If the cluster is still staying out of sync, the below article could help drill down and identify which object(s) are not getting synchronised.

 

Technical Tip: Troubleshooting a checksum mismatch... - Fortinet Community

 

Best regards,

Jin

ede_pfau
SuperUser
ede_pfau
SuperUser
March 13, 2026

It looks like you should debug the RADIUS authentification.

All details and commands here:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-RADIUS-authentication-troubleshooting/ta-p/196192

 

It's the fnbamd daemon, and maybe radiusd. "response is empty" doesn't look good...

ede_pfau
SuperUser
ede_pfau
SuperUser
March 13, 2026

just for reference as I know you've already read this:

Technical Tip: How to use multiple groups with EAP for IKEv2 (SAML/RADIUS/local)  

 

especially take note of how the policy is to be configured, for instance the source addresses!

Terms & ConditionsAccessibility statement