Migration from SSL VPN with RADIUS (FreeRADIUS + privacyIDEA) to IPsec VPN

Hello everyone,

I currently have an SSL VPN tunnel where authentication is performed via RADIUS using FreeRADIUS and privacyIDEA with 2FA. This setup works perfectly. It is deployed on a FortiGate 100F running FortiOS 7.6.2. I cannot upgrade to newer versions because SSL VPN support would be removed. Clients connect using the FortiClient VPN-only client.

I am trying to migrate to an IPsec VPN with a similar configuration. However, despite extensive research, I have not found a reasonable way to replicate the SSL VPN setup with IPsec.

According to the documentation, in order for IKEv2 to work with a RADIUS server such as FreeRADIUS, the EAP method on the FortiClient must be configured as EAP-TTLS/PAP instead of the default EAP-MSCHAPv2.

The problem is that configuring this in the FortiClient VPN-only requires editing the XML configuration file. This is a very advanced configuration step that I can perform myself, but I cannot reasonably require my end users to do so. Even with this workaround, true two-factor authentication would still not work properly, unless the password and token are concatenated, which is not ideal.

I have seen that this scenario can be handled using FortiClient ZTNA, but this solution is well beyond our budget.

Does anyone know of a way to configure an IPsec VPN with RADIUS-based two-factor authentication without requiring manual editing of the FortiClient XML configuration file?

It seems odd to me that the FortiGate requires us to move away from SSL VPN, yet does not provide equivalent authentication options for IPsec VPN.

Thank you in advance for any guidance or suggestions.