Technical Tip: FortiGate Dialup VPN IKEv2 RADIUS NPS with Strongswan on Ubuntu

WelingtonMatias · ‎06-28-2025

Description

This article describes how to configure an IKEv2 client-to-site VPN tunnel between a FortiGate and a StrongSwan VPN gateway on a Linux Ubuntu.

Scope

FortiGate v6.x,v 7.x.

Solution

On RADIUS NPS.

Follow this KB article: Technical Tip IKEv2 Dialup IPsec tunnel with RADIUS.

On Linux.

Install StrongSwan:

sudo apt-get update
sudo apt install strongswan libcharon-extra-plugins -y

Edit the file /etc/ipsec.conf and input the correct configuration:

config setup
charondebug="ike 2, cfg 2, knl 2, net 2"

conn ikev2-vpn
auto=start
keyexchange=ikev2
type=tunnel
left=%defaultroute
leftid=wells@mylab.local
leftauth=eap
leftsourceip=%config
leftsubnet=0.0.0.0/0
right=172.16.20.104
rightid=%any
rightauth=psk
rightsubnet=192.168.100.0/24
eap_identity="wells@mylab.local"
ike=aes256-sha256-modp2048
esp=aes256-sha256-modp2048
dpdaction=restart
dpddelay=30s
fragmentation=yes
compress=no

* The left side is client vpn strongswan

* the right side is FortiGate firewall.

right=172.16.20.104 ---- "Wan Interface"

rightsubnet=192.168.100.0/24 --- "Network bellow the FortiGate firewall"

Edit the file /etc/ipsec.secrets:

# This file holds shared secrets or RSA private keys for authentication.

# RSA private key for this host, authenticating it to any other host
# which knows the public part.
: PSK "1234Mudar"

wells@mylab.local : EAP "1234Mudar

On FortiGate:

User & Authentication Menu -> RADIUS Server -> Create New.

Test User Credentials.

Create RADIUS User on FortiGate:

User & Authentication -> User Definition -> Create New.

On FortiGate CLI.

VPN IPsec configuration.

config vpn ipsec phase1-interface
edit "radius"
set type dynamic
set interface "port1"
set ike-version 2
set peertype any
set net-device disable
set mode-cfg enable
set proposal aes256-sha256
set dpd on-idle
set dhgrp 14
set eap enable
set eap-identity send-request
set authusrgrp "Radius" <--- RADIUS Group name.
set assign-ip-from name
set dns-mode auto
set ipv4-split-include "LocalNetwork"
set ipv4-name "SSLVPN_TUNNEL_ADDR1"
set save-password enable
set psksecret ENC wmXqS5qSQSOygTxhHPVEZ7HpNEblsplFWFk9M589dl/OD5rz2sRPUSeCVPw7DLv644qh66xHnZUmOWxN2JVQB3p