FortiGate IPSec with certificate based authentication and ldap integration group based policies

Forum|Forum|3 months ago
May 27, 2026
4 replies
151 views

We are planning to migrate from SSL VPN to IPsec VPN using certificate-based (signature-only) authentication.

Since the VPN will be used by both employees and contractors, we need to implement group-based policy controls similar to what we currently have with SSL VPN.

I have configured the user peer with ldap-mode principal-name, which maps the certificate UPN to the LDAP user. This part is working as expected (if user is disabled, it won’t allow log in).

However, I have not been able to get LDAP group-based matching working in firewall policies.

I have 7.2.12 version at the moment, maybe newer version has this fixed?

FortiGate

Sheikh

Staff

Hello @Vatsake,

Please check this technical document.

regards,

Sheikh

If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.

VatsakeAuthor

Visitor III

That's for SSL VPN

AEK

SuperUser

Did you check this teck tip:

However I’m not sure if the “User group” can be set to “Inherit from Policy” when using cert based authentication. You may try via CLI in case it doesn’t appear in WebUI.

AEK

VatsakeAuthor

Visitor III

If I enable EAP, that means I’d have to set EAP credentials in FortiClient also in addition to certificate. - I don’t really want that.
The certificate already belongs to the user. Why need to identify yourself twice
But I guess what I’m asking is impossible :)

Sign up

Login with SSO

Login to the community

Login with SSO