Skip to main content
MG4
MG4
Explorer III
December 2, 2024
Solved

RADIUS proxy authentication for FortiGates?

  • December 2, 2024
  • 3 replies
  • 6193 views

Hello everyone,

I recently discovered that the FortiAuthenticator supports a proxy authentication mode for remote RADIUS servers:
FortiAuthenticator Documentation

However, the FortiGate does not seem to offer a similar option:

If you want to set up remote Dial-Up IPsec VPN tunnels using EAP-TLS authentication via Microsoft NPS (RADIUS), it seems you would need to purchase a FortiAuthenticator solely to forward the requests to the remote RADIUS server.

Will FortiGate ever introduce a proxy mode for authentication via remote RADIUS servers?

Best answer by pminarik

The FortiGate is simply instructed to:

  • use EAP ("set eap enable" in phase1 config)
  • instructed which EAP server to use (indirectly via group selection -> use that group's auth server)

EAP methods are not configured on the FortiGate, this is negotiated between the supplicant (endpoint) and the EAP server through the "EAP tunnel". The correct place to enforce acceptable EAP methods is thus on the EAP/RADIUS server.

 

Btw, AFAIK FortiClient does not support EAP-TLS. When configured to send a user certificate, cert-based auth is performed (non-EAP).

 

As for documentation, you can use this as a starting point:

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/726232/windows-ikev2-native-vpn-with-user-certificate

 

I haven't tested it personally, so I cannot vouch for it to be 100% correct, but it sufficiently demonstrates how the config should look. Notice how there's no step where you configure which EAP method is to be used in the FGT's config.

3 replies

sjoshi
Staff
sjoshi
Staff
December 2, 2024

can you check if this helps you out:-

https://community.fortinet.com/t5/FortiNAC/Technical-Tip-RADIUS-Proxy-with-FortiGate-and-FortiAuthenticator/ta-p/191167

Thanks, Salon
    MG4
    MG4Author
    Explorer III
    December 2, 2024

    The question was whether the FortiGate will ever get the proxy mode or if it will remain a feature exclusive to the FortiAuthenticator. Because buying a FortiAuthenticator solely to forward the requests to the remote RADIUS server would be ridiculous.

    adambomb1219
    SuperUser
    adambomb1219
    SuperUser
    December 2, 2024

    Why do you want to do this?  Why not use SAML?  Why not just forward those RADIUS requests directly to another RADIUS server?

    MG4
    MG4Author
    Explorer III
    December 2, 2024

    The FortiGate currently supports forwarding only MS-CHAPv2, MS-CHAP, CHAP, or PAP requests—not EAP-TLS. Unlike the FortiAuthenticator with proxy mode, the FortiGate cannot directly forward authentication requests to a remote RADIUS server, only the supported authentication protocols. Currently, I only want to set up EAP-TLS authentication for remote dial-up VPN clients, not many (at most 10).

    adambomb1219
    SuperUser
    adambomb1219
    SuperUser
    December 3, 2024

    Can EAP-TLS be terminated directly on the firewall though?  Is there a need for RADIUS here at all?  Can you just authenticate based on TLS trust alone?  Sorry I'm not too familiar with the setup for dial-up VPN.  Are you talking for FortiClient remote users or firewall to firewall VPN?

      pminarik
      Staff
      pminarik
      Staff
      December 3, 2024

      FortiGate has no limitation as to which RADIUS server can be used to process EAP authentication for it.

      Direct integration with NPS works just fine. FortiAuthenticator is not required for this.

       

      What you see in the RADIUS server settings (auto|PAP|CHAP|MS-CHAP|MS-CHAPv2) is configuration relevant purely for non-EAP authentication.

      EAP authentication is used automatically in a feature if that feature supports it and is configured to use it. (802.1x switch auth, WPA-Enterprise on Wifi, EAP auth for IKEv2 IPsec)

       

      But be aware that if you want to do 2FA (username + password + OTP) over EAP, you will likely have issues with third-party servers. There's no established standard for it, so it's bit of a wild west. (FCT+FGT+FAC do it in a custom fashion over modified EAP-MS-CHAPv2, if that interests you).

      MG4
      MG4Author
      Explorer III
      December 3, 2024

      Is there a knowledgebase article about this scenario? Because I don't see how you could configure such a IPsec Tunnel on the FortiGate. Because the only way would be with signatures. Having to build 10 different tunnels for each user and his certificate.

      Scenario:
      FortiClient <VPN with EAP-TLS Authentication> FortiGate <User Authentication> Remote-RADIUS-Server

      1. The VPN client uses a user certificate for authentication.
      2. The FortiGate forwards the authentication request to the remote RADIUS server.
      3. The RADIUS server validates the user certificate.
      4. IKEv2 Phase 1 is completed
      5. ...
      pminarik
      Staff
      pminarikAnswer
      Staff
      December 3, 2024

      The FortiGate is simply instructed to:

      • use EAP ("set eap enable" in phase1 config)
      • instructed which EAP server to use (indirectly via group selection -> use that group's auth server)

      EAP methods are not configured on the FortiGate, this is negotiated between the supplicant (endpoint) and the EAP server through the "EAP tunnel". The correct place to enforce acceptable EAP methods is thus on the EAP/RADIUS server.

       

      Btw, AFAIK FortiClient does not support EAP-TLS. When configured to send a user certificate, cert-based auth is performed (non-EAP).

       

      As for documentation, you can use this as a starting point:

      https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/726232/windows-ikev2-native-vpn-with-user-certificate

       

      I haven't tested it personally, so I cannot vouch for it to be 100% correct, but it sufficiently demonstrates how the config should look. Notice how there's no step where you configure which EAP method is to be used in the FGT's config.

        Terms & ConditionsAccessibility statement