Windows IKEv2 native VPN with Signature, Public Wildcard Certificate, MS-CHAPv2, Duo and NPS
I am attempting to setup an ipsec Ikev2 VPN using the Windows Native Client.
The attempt to connect fails immediately with the "IKE authentication credentials are unacceptable" error. I have found this article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-IKE-authentication-credentials-are-unacceptable/ta-p/382297. However, I am using our publicly signed Wildcard certificate, so should not need to upload the CA certificate to the client as stated in the article.
I have also found this article which is a similar but not exact configuration: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-IKEv2-IPsec-VPN-MS-CHAPv2-with-Windows-Phone-8-1/ta-p/195470#:~:text=As%20for%20Internet%20connection%2C%20change,the%20rest%20of%20the%20settings.
This video is also similar but not exact: https://www.youtube.com/watch?v=a0W-NyI6m10
Lastly this is an official guide from FortiGate that's also similar: https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/726232/windows-ikev2-native-vpn-with-user-certificate
I am coming from a Watchguard firewall that creates a PowerShell script and batch file to run on the windows client to install their certificate and setup the VPN. I'd like a setup as similar to that on my new FortiGate to minimize changes for the clients.
My Windows client is setup with MS-CHAP v2 as the authentication method and the client has both computer and user certificates with "client authentication" as one of the intended purposes pushed out via group policy auto-enrollment from my local CA.
I have uploaded the CA from my local CA to the FortiGate and am using that as the peer certificate. The user group is tied to radius which goes to my Duo Athentication proxy and then hits my NPS server. If I test the radius server in the Radius setup of the FortiGate, the test is successful as long as the NPS server has MS-CHAPv2 enabled under "less secure methods". I also have PEAP with the certifcate issued by the local CA to the NPS server and the EAP Type as Secured Password EAP-MSCHAPv2.
When I attempt the connection, nothing at all is logged on the NPS server, so I believe the connection is failing before it even attempts to connect to the NPS server.
Here is my configuration:
edit "Windows VPN"
set type dynamic
set interface "wan1"
set ike-version 2
set authmethod signature
set net-device disable
set mode-cfg enable
set ipv4-dns-server1 mydnsserver
set proposal aes256-sha1 3des-sha1 aes256-sha256 aes128-sha256 aes128-sha1
set comments "VPN: Windows VPN -- Created by VPN wizard"
set dhgrp 14 5 2
set eap enable
set eap-identity send-request
set wizard-type dialup-windows
set authusrgrp "IKEv2-Users"
set transport auto
set certificate "*.mycompany.com"
set peer "mycompany.local CA"
set ipv4-start-ip 192.168.114.0
set ipv4-end-ip 192.168.114.255
set ipv4-split-include "Trusted_Subnet"
next
end
