Technical Tip: SSL VPN using authentications with NPS

[jvergara]

Description
This article describes the basic configuration on your NPS in order to authenticate SSL VPN Clients.

Network Policy Server (NPS) is the Microsoft implementation of a Remote Authentication Dial-in User Service (RADIUS) server and proxy. It is the successor of Internet Authentication Service (IAS).

Solution

Basic configuration:

# config user radius
     edit <radius_name>
          set server "10.200.0.11"                            <----- Server IP.
          set secret <string>
          set nas-ip 10.200.0.254                             <----- FortiGate IP.
     end

# config user group
     edit <group_name>
          set member <radius_name>

# config match
     edit 1
          set server-name <radius_name>
          set group-name "group1"                             <----- This string must match the string used on Network Policies  -> Properties  -> Settings  -> Vendor Specific.
     next
 end

The group can be used for the SSL VPN configuration (assign a SSL Portal and define the firewall policy).

On the attached file, there is the configuration of the NPS.