IKEv2 IPsec VPN remote connection fails — EAP failed for LDAP user/group authentication

Question

🧱 EnvironmentFortiGate model: FG-101FFortiOS version: (please add, e.g. 7.4.3 or 7.2.6)VPN type: IKEv2 IPsec (remote access)Authentication: LDAP users & groupsClient: FortiClient 7.4.3 (Windows 10 Pro 64-bit)🪪 ScenarioI’m configuring an IKEv2 IPsec remote access VPN that authenticates users via an LDAP server.The connection is established from FortiClient successfully up to Phase-1 (SA_INIT), but it fails during user authentication (EAP phase).EAP failed for user "test"EAP response is emptyconnection expiring due to EAP failure

funkylicious · Accepted Answer

I can confirm that setting the param in XML in EMS will push the setting to the client.

here's my working IPsec over TCP IKEv2 config:

config vpn ipsec phase1-interface     edit "RA-IKEv2"         set type dynamic         set interface "wan1"         set ike-version 2         set local-gw <>         set peertype any         set net-device enable         set mode-cfg enable         set proposal aes128-sha1 aes256-sha256         set dpd on-idle         set dhgrp 20         set eap enable         set eap-identity send-request         set transport tcp         set ipv4-start-ip 10.0.2.100         set ipv4-end-ip 10.0.2.200         set dns-mode auto         set ipv4-split-include "DialUP_split"         set psksecret <>         set dpd-retryinterval 60     next end  show system settings | grep tcp     set ike-tcp-port 40443 end  EMS XML, under ike_settings: <transport_mode>1</transport_mode> <tcp_port>40443</tcp_port> <udp_port>500</udp_port> <eap_method>2</eap_method>   diagnose vpn ike gateway list name: RA-IKEv2_0 version: 2 interface: wan1 17 addr: IP:40443 -> IP:49487 tun_id: 10.0.2.100/::10.0.0.9 transport: TCP created: 14s ago eap-user: LDAP-USER 2FA: no groups:   RA-IKEv2 5

For IPsec over UDP IKEv2:

- you use unset transport under phase-1

- in EMS set Encapsulation to Auto

<transport_mode>2</transport_mode>

<tcp_port>40443</tcp_port>

<udp_port>500</udp_port>

<eap_method>2</eap_method>

confirmation:

diagnose vpn ike gateway list name: RA-IKEv2_0 version: 2 interface: wan1 17 addr: IP:4500 -> IP:64917 tun_id: 10.0.2.100/::10.0.0.11 transport: UDP created: 228s ago eap-user: LDAP-USER groups:   RA-IKEv2 5

I don't set the LDAP usergroup in IPsec , but in the firewall rule.

funkylicious · Answer

hi,can you share a sanitized config for the ipsec phase-1 ? L.E. try adding this line in your FortiClient config file by exporting it adding the line and then importing it back , under add the line 2 after the import validate that the setting is set by looking in the registry , \HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FortiClient\IPSec\Tunnels\[tunnel name]\P1eap_method (0x00000002) source: https://community.fortinet.com/t5/FortiGate/Technical-Tip-IKEv2-tunnel-fails-when-LDAP-based-usergroup-is/ta-p/214966

🧱 Environment

🪪 Scenario

Sign up

Login with SSO

Login to the community

Login with SSO