Technical Tip: Duo MFA user can connect to SSLVPN without passcode

Dongfang_Li_FTNT · ‎07-29-2022

Description

This article describes the scenario where the user connects to the SSLVPN using Duo MFA and the user finds out that connection succeeds either he approves or denies the passcode.

Run authentication and SSLVPN debug:

# diag debug reset

# diag debug application fnbamd -1
# diag vpn ssl debug-filter clear
# diag vpn ssl debug-filter src-addr4 a.b.c.d --> public IP addr of remote PC

# diag debug application sslvpn -1
# diag debug enable

Get below debug after the Duo user has denied the passcode:

find_matched_usr_grps-Group 'Ldap-grp' passed group matching
find_matched_usr_grps-Add matched group 'Ldap-grp'

……

deconstruct_session_id:429 decode session id ok, user=[test],group=[Ldap-grp],authserver=[ldap],portal=[tunnel-access], host=[*.*.*.*]

The Duo user also belongs to the ldap user group 'Ldap-grp'.

Scope

FortiGate version firmware.

Solution

In the SSLVPN setting, authentication-rule, if both LDAP user group and Duo user group are set at the same time, Duo user connection might be authenticated by the LDAP method instead of Radius method.

The realm can resolve the issue.

The realm provides different path to different authentication method.

Set the LDAP user group in one realm, and the Duo user group in another realm.

Do not mix different authentication methods in one realm, so the LDAP user group and Duo user group should not put in the same realm.

# config vpn ssl settings

config authentication-rule

edit 1

set groups " Ldap-grp”

set portal "tunnel-access"

set realm "ldap"

set groups "Duo-grp"

set portal "tunnel-access"

set realm "duo"

The global setting 'remoteauthtimeout' is set to 5 seconds by default.

For Duo MFA authentication, it will take more than 5 seconds.

Extend the timer, for example, extend to 60 seconds. The maximum is 300 seconds.

# config system global

set remoteauthtimeout 60

end

Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/724772/ssl-vpn-multi-realm