Description
This article describes how to configure a dial-up IPsec VPN using IKEv2 and Multifactor authentication with FortiToken.
Scope
FortiGate, FortiToken, RADIUS, and Active Directory.
Solution
The XAuth method is only available for IKEv1. The authentication framework supported for IKEv2 is EAP. To select a user group, EAP must be enabled, which requires a RADIUS server.
Considering Microsoft NPS is popular, the configuration example below is performed with NPS as a RADIUS server.
Note:
The remote RADIUS server must support EAP-MSCHAPv2 because for IKEV2, FortiClient will use EAP-MSCHAPV2.
Considering DUO is widely used as a remote authentication and MFA solution, keep in mind the limitations highlighted in: Does the Duo Authentication Proxy support MS-CHAPv2 or EAP-MSCHAPv2?
Configuration Steps for Microsoft NPS.
Note:
This configuration assumes the NPS server role has been installed and registered to Active Directory.
- Create a RADIUS Client for the FortiGate IP address and the Shared Secret to be configured in FortiGate:
-
Create a Connection Request Policy with the condition for FortiGate's IP Address and keep other settings as default:
-
Create a Network Policy. Make sure it is enabled and 'Grant access' is selected.
-
Add a condition to match a specific Active Directory group:
-
Configure the constraints tab as below. Make sure MSCHAPv2 is also selected for FortiToken to work, and add 'Microsoft: Secured password (EAP-MSCHAP v2)'.
-
Keep the 'Settings' tab with default options, and select 'OK':
Configuration Steps for FortiGate:
- Create a RADIUS server entry if there is not one already. This is the IP address of the NPS:
-
Create a remote RADIUS user or modify the existing one as per below:
-
Create or modify a firewall group and add the user to it:
-
Create the Dialup IPsec tunnel as shown below. This can be done from the 'VPN Creation Wizard' to simplify firewall policy and object creation. EAP options must be configured from the CLI.
config vpn ipsec phase1-interface
edit "IKEv2"
set type dynamic
set interface "port2"
set ike-version 2
set peertype any
set net-device disable
set mode-cfg enable
set ipv4-dns-server1 172.16.1.10
set proposal aes256-sha256
set comments "VPN: IKEv2 (Created by VPN wizard)"
set dhgrp 21
set eap enable
set eap-identity send-request
set authusrgrp "Escalations-Radius-DC1"
set ipv4-start-ip 172.16.242.50
set ipv4-end-ip 172.16.242.60
set ipv4-split-include "LAN1"
set psksecret ENC
next
end
config vpn ipsec phase2-interface
edit "IKEv2"
set phase1name "IKEv2"
set proposal aes256-sha256
set dhgrp 21
set comments "VPN: IKEv2 (Created by VPN wizard)"
next
end
Note:
EAP configuration can only be done from the CLI.
config vpn ipsec phase1-interface
edit "IKEv2"
set eap enable
set eap-identity send-request
set authusrgrp "Escalations-Radius-DC1"
next
end
Troubleshooting.
The following debugs are useful when troubleshooting issues with the configuration above.
diagnose debug console timestamp enable
diagnose debug application ike -1
diagnose debug application fnbamd -1
diagnose debug application eap_proxy -1
diagnose debug enable
Note:
Push notification set-up over dial-up is supported only starting with v7.2.8, v7.4.4, v7.6.0, and below FortiClient versions:
- v7.2.4 and above for Windows.
- v7.2.5 and above for MAC.
- v7.2.5 and above for Linux.
The IPSec dial-up connection with an IOS device will fail to connect if using the FortiToken MFA, as it will not receive the token push. As a workaround, include the token in the password field while connecting:
- Password: p@ssw0rd
- Token Code: 345678
The user will enter p@ssw0rd345678 when prompted for the password.
Related documents:
Technical Tip: How to configure IPsec VPN Tunnel using IKE v2
