Technical Tip: Enable LDAP user to renew expired password via VPN IPsec

[contreraspa]

Description	This article describes the required configuration to allow LDAP users connected to a VPN IPsec Dial-up tunnel to change their password when it expires.
Scope	FortiGate with VPN IPsec tunnels in IKE version 1.
Solution	To allow password renewal from the FortiGate using any connection method (Wired, Wireless, VPN) is required to enable secure LDAP connection (LDAPS), and the password-renewal option must be enabled in the LDAP Server, as explained in the following technical document: Technical Tip: How to enable password renewal of remote LDAP user through FortiGate VPN SSL is being replaced by VPN IPSec in new FortiOS versions: SSL VPN tunnel mode replaced with IPsec VPN So VPN SSL should be migrated to VPN IPSec; however, in some cases, these configurations are based on LDAP Authentication, so the VPN SSL should be migrated using the instructions in the following document: Technical Tip: Remote Access IPsec VPN with LDAP authentication To allow LDAP users to change their password when it expires, the following configuration in Phase1 of the tunnel is required: config vpn ipsec phase1-interface     edit "Remote Access"         set type dynamic         set interface "port1"         set mode aggressive         set peertype any         set net-device enable         set mode-cfg enable         set proposal aes256-sha256         set dpd on-idle         set dhgrp 5         set xauthtype auto         set reauth enable         set authusrgrp "LDAP-GRP"         set ipv4-start-ip 172.16.20.1         set ipv4-end-ip 172.16.20.10         set ipv4-netmask 255.255.255.0         set dns-mode auto         set ipv4-split-include "Remote Access_split"         set unity-support disable         set psksecret          set dpd-retryinterval 60     next end The option reauth allows the FortiGate to resend the user credentials when client software requires a password change: Note: This configuration only works with IKE v1, since IKE v2 uses EAP for authentication, and LDAP Servers are not compatible with EAP for IKE v2. EAP-TTLS is required; more information is available in the following documents: Technical Tip: How to configure IPsec VPN Tunnel using IKE v2 Technical Tip: IKEv2 tunnel fails when LDAP based usergroup is used for EAP Technical Tip: IKEv2 dial up VPN with LDAP authentication Note: Due to an ongoing issue with reauth parameter this is not available on 7.4.8.