Migrating from Anyconnect to Forticlient - Impossible to connect error 455
Hi,
We are migrating from AnyConnect to FortiClient and encountering many problems. Currently, a RADIUS server (NPS) is being used, which passes Cisco RADIUS attributes such as IP address, subnet mask, and a dynamic ACL (DAC) for each user.
For each user created in Active Directory, a static IP is assigned, the RADIUS profile to use is specified, and the corresponding ACL policies are created on the ASA.
On the Fortigate side, I have configured the RADIUS servers and set up the entire SSL portal. Since the IP is passed statically, I found a guide that suggested setting "set ip-mode user-group" under the portal.
I also created the corresponding ACL that allows from SSL VPN to any, but as soon as the MFA notification arrives with Duo, I get permission denied (error -455) and the process stops at 43%.
Does anyone have any suggestions?
I've tried everything but can't solve it.
Below is the configuration.
config vpn ssl web portal
edit "RADIUS1_PORTAL" <---- my 1st portal
set tunnel-mode enable
set ip-mode user-group
set ip-pools "Pool_Vpn"
next
edit "RADIUS2_PORTAL" <---- my 2nd portal
set tunnel-mode enable
set ip-mode user-group
set ip-pools "Pool_Vpn"
next
end
config vpn ssl settings
set banned-cipher SHA1 SHA256 SHA384
set tunnel-ip-pools "Pool_Vpn"
set dns-server1 8.8.8.8
set source-interface "outise_vpn"
set source-address "all"
set default-portal "tunnel-access"
config authentication-rule
edit 1
set groups "radius1" <-------1st radius i'm using
set portal "RADIUS1_PORTAL"
next
edit 3
set groups "radius2" <-------2nd radius i'm using
set portal "RADIUS2_PORTAL"
next
end
end
config vpn ssl web portal
edit "RADIUS1_PORTAL"
set tunnel-mode enable
set ip-mode user-group <------------------to use framed-ip from radius attributes (radius is passing the ip statically)
set ip-pools "Pool_Vpn"
next
edit "RADIUS2_PORTAL"
set tunnel-mode enable
set ip-mode user-group <------------------to use framed-ip from radius attributes (radius is passing the ip statically)
set ip-pools "Pool_Vpn"
next
end
POLICY CONFIGURATION
config firewall policy
edit 1
set name "Vpn to inside"
set uuid 6bc672ce-0fd1-5
set srcintf "ssl.Vpn"
set dstintf "any"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all
set groups "radius1" "radius2"
next
end