Skip to main content
RF2
RF2
New Member
January 10, 2025
Question

Help setting up Fortigate IPSEC VPN with Microsoft MFA

  • January 10, 2025
  • 3 replies
  • 9136 views

Hello,

We have a customer currently using IPSEC VPN using a pre shared key. The users sign-in using their on-prem AD username and password. We have ADSync setup sync the accounts to Microsoft 365 and the PC’s are hybird joined. The customer would like to start using Microsoft MFA to authenticate the VPN. I can’t seem to find a step by step guide to set this up has anyone setup this that can provide information on how to set it up correctly? Ideally I want to keep the current IPSEC setup but just add Microsoft MFA to authenticate.

3 replies

Dhruvin_patel
Staff
Dhruvin_patel
Staff
January 12, 2025

Greetings!

 

To set up Microsoft MFA for authentication on the existing IPSec VPN using a pre-shared key with on-premise AD synced to Microsoft 365, you can follow these steps:

 

1. Ensure Prerequisites:
- Confirm that your on-premise AD is synced to Microsoft 365 using AD Connect.
- Make sure your PCs are hybrid joined to Azure AD.

 

2. Configure Microsoft NPS:
- Install and configure Network Policy Server (NPS) on your on-premise server.
- Add a RADIUS client for your FortiGate IP address with a shared secret.

 

3. Enable EAP on FortiGate:
- Since XAUTH is not present for IKEv2, enable EAP on FortiGate for user group selection.

 

4. Configure RADIUS Server on FortiGate:
- Set up the RADIUS server on FortiGate with the NPS server details.

 

5. Enable MFA for Users:
- In Azure portal, go to Azure Active Directory > Users > Multi-Factor Authentication.
- Enable MFA for the users who will be authenticating for VPN access.

 

6. Test the Configuration:
- Test the VPN connection using FortiClient with a user account that has MFA enabled.
- Verify that the authentication process prompts for MFA verification after entering the AD username and password.

 

Following these steps, you can integrate Microsoft MFA for authentication on the existing IPSec VPN setup while keeping the current configuration with a pre-shared key.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IKEv2-Dialup-IPsec-tunnel-with-Radius-and/ta-p/220818

https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/azure-administration-guide/517582/configuring-forticlient-vpn-with-multifactor-authentication

 

Best Regards!

If you have found a solution, please like and accept it to make it easily accessible for others.

 

    RF2
    RF2Author
    New Member
    January 14, 2025

    Hi Dhruvin Patel,

     

    The customer already has radius setup for their WiFi will this affect that? They also have LDAP Servers setup can i use that group when setting this up? Also do i need purchase FortiToken's for this to work?

    RF2
    RF2Author
    New Member
    January 14, 2025

    Could i set this up? How to configure Microsoft Entra ID SAML ... - Fortinet Community

    AEK
    SuperUser
    AEK
    SuperUser
    January 14, 2025

    Hi RF2

    I think you should integrate MS MFA to the RADIUS server that is used by IPsec VPN as authentication server.

    You don't need for FortiTokens since you already use MS MFA.

    AEK
    RF2
    RF2Author
    New Member
    January 15, 2025

    Hi AEK,

    Thanks for your reply. Is radius server the only solution here? As the customer is already using IPSEC VPN with LDAP enabled.

    AEK
    SuperUser
    AEK
    SuperUser
    January 15, 2025

    Hi RF2

    Honestly I don't know if LDAP authentication offers MFA like RADIUS.

    Hope some LDAP-experienced member can help on that.

    AEK
    Terms & ConditionsAccessibility statement