Technical Note: How to configure IPsec dialup VPN with certificate based authentication

[jintrah_FTNT]

Description

This article explains the steps to configure the IPsec dial-up VPN with certificate based authentication.

Scope

FortiClient.

Solution

Requirements:

• CA certificate.
• Server certificate.
• Client certificate.

The following example deploys openssl commands to generate the required certificates.

1. Generate CA Certificate ca.crt:

opensslgenrsa -des3 -out ca.key 4096
opensslreq -new -x509 -days 365 -key ca.key -out ca.crt

2. Generate Server Certificate server.crt:

opensslgenrsa -des3 -out server.key 4096
opensslreq -new -key server.key -out server.csr
openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkeyca.key -set_serial 01 -out server.crt

3. Generate Server Certificate client.crt and convert to .p12 format for exporting with private keys:

opensslgenrsa -des3 -out client.key 4096
opensslreq -new -key client.key -out client.csr
openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkeyca.key -set_serial 01 -out client.crt
openssl pkcs12 -export -in client.crt -inkeyclient.key -certfile ca.crt -name "test" -out client.p12

4. FortiGate and FortiClient Configuration:

1. Import CA and Server certificates on FortiGate.

2. Configure user peer and peer usergroup.

config user peer
    edit user1
        set ca CA_Cert_2
    end

config user peergrp
    edit user_group1
        set member user1
    end

3. FortiGate IPsec config.

4. FortiClient config.

The CA certificate is imported and placed in the Trusted Root Certification Authorities of IE.

Select Authentication Method in the IPsec VPN connection settings.

Load the client certificate (.p12) under File -> Settings -> Certificate management.

Related articles:

Technical Tip: PKI peer user/usergroup creation for certificate authentication