Technical Tip: How to configure dialup IPsec VPN using RSA

[Dinesh_FTNT]

Description

This article explains how to configure Client Site IPsec VPN using RSA. The following certificates will be required to configure dial-up VPN using RSA:

• Server Certificate.
• CA certificate.
• User certificate.

Scope

FortiGate.

Solution

The following steps can be used to configure certificate-based authentication for dial-up VPN.

On the FortiGate, add the server certificate under Local Certificates.

Add the CA certificate under CA Certificates.

Create PKI users.

config user peer
    edit "ssluser1"
        set ca "CA_Cert_1"
        set subject "ssluser1"  <- Subject should match the user certificate.
    next
end

This should be created for all other users.

Add the PKI users to PKI groups.

config user peergrp
    edit "peergrp"
        set member "ssluser1"
    next
end

On the Dial-up VPN profile, select the server certificate and peergroup.

On the Client's PC:
Add the user certificate on FortiClient.

Go to File -> Settings -> Certificate Management, enable 'Use Local Certificate Uploads (IPsec only)' and import the user certificate.

Select the User certificate on the VPN profile.

The user will now be able to connect to the VPN successfully.

Troubleshooting:
If an issue is still observed in establishing VPN, debug using the following commands.

diagnose vpn ike log-filter dst-addr4  x.x.x.x
diagnose debug application ike -1
diagnose debug enable

Here, x.x.x.x is the PC IP address from which the VPN is to be established.

To stop the debugs, run the following commands:

diagnose debug disable
diagnose debug reset

Note:

Starting from v7.4.1, the 'diagnose vpn ike log-filter dst-addr4' command has been changed to 'diagnose vpn ike log filter rem-addr4'.