Technical Tip: Windows IKEv2 native VPN with machine certificate

[simonz_FTNT]

Description	This article describes how to configure FortiGate to accept connection when using Windows native VPN with a machine certificate, the guide does not cover how to generate a machine certificate and it would be necessary to refer to Microsoft documentation.
Scope	FortiGate.
Solution	Generate and sign a CSR and import the signed certificate to the FortiGate: On the FortiGate go to System -> Certificates and select Create/Import -> Generate CSR. Configure the CSR: (below is just an example, change according to reflect the environment). Certificate Name vpn.lab.local ID Type Domain Name Domain Name vpn.lab.local Subject Alternative Name DNS:vpn.lab.local Configure the remaining settings as required, then select OK. Download the CSR to a location that is accessible to the CA server, in this example: C:\CSR\. Sign the CSR with the local CA server: Open the command prompt as an administrator and enter the following: certreq -submit -attrib 'CertificateTemplate:WebServer' C:\CSR\vpn.lab.local.csr The Certification Authority List window opens. 2. Select the CA and select OK. 3. Save the signed certificate with a .cer file extension to a location that is accessible from the FortiGate. Import the signed certificate to the FortiGate: On the FortiGate, go to System -> Certificates and select Create/Import -> Certificate. Select Import Certificate. Set Type to Local Certificate. Select Upload and locate and select the signed certificate Select Create then select 'OK'. Then import the local root CA certificate into FortiGate: Technical Tip: How to export root CA from Certificate Authority Server and import to FortiGate Once certificates have been imported, it is necessary to enable PKI peer setting in Fortigate so that machine certificates can be verified against root CA. config user peer     edit <name>         set ca "CA_Cert_1” <----- Refer to the above KB article. end Proceed with VPN configuration in the FortiGate CLI: VPN Phase 1 setting: config vpn ipsec phase1-interface     edit <name>         set type dynamic         set interface "port10" <----- Replace with the WAN interface of the choice.         set ike-version 2         set authmethod signature         set net-device disable         set mode-cfg enable         set ipv4-dns-server1 xx.xx.xx.xx <----- Point to AD server DNS.         set proposal aes128-sha256 aes256-sha256 aes128-sha1         set localid "vpn.syd.fortilabapac.lab" <----- Set according to FQDN of the VPN.         set dpd on-idle         set dhgrp 14 5 2         set certificate "vpn.syd.fortilabapac.lab" <----- Replace with a certificate generated by CSR.         set peer "NativeDialup_peer" <----- Replace with user peer name configured previously.         set ipv4-start-ip 10.100.1.1         set ipv4-end-ip 10.100.1.150         set ipv4-split-include "LAN"         set dpd-retryinterval 60     next end VPN Phase 2 setting: config vpn ipsec phase2-interface     edit <name>         set phase1name <phase1 name>         set proposal aes128-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305         set pfs disable         set keepalive enable     next end Client VPN configuration (Windows 10): Select Start, then select Settings -> Network & Internet -> VPN, and select  Add a VPN connection to start configuration. Follow the below configuration, and ensure to use FQDN in the Server name or address or there will be an error during connection. After saving the setting, select the Change adapter option to change the connection to use the machine certificate. 'Right-click' on VPN connection, and select Properties -> Security. Select Use machine certificate and press OK. Go back to Settings -> Network & Internet -> VPN  to test the VPN connection. Troubleshooting: In case there is an issue with the connection, run the below debug command to check. diagnose debug application ike -1 diagnose debug enable Below sample output on the certificate verification: ike 0:dialup_cert:10: Validating X.509 certificate ike 0:dialup_cert:10: peer cert, subject='Computers', issuer='syd-FORTILABAPAC-AD-CA-2' ike 0:dialup_cert:10: peer ID verified ike 0:dialup_cert:10: building fnbam peer candidate list ike 0:dialup_cert:10: FNBAM_GROUP_NAME candidate 'NativeDialup_peer' ike 0:dialup_cert:10: certificate validation pending ike 0:dialup_cert:10: fnbam reply 'NativeDialup_peer' ike 0:dialup_cert:10: fnbam matched peer 'NativeDialup_peer' ike 0:dialup_cert:10: certificate validation complete ike 0:dialup_cert:10: certificate validation succeeded ike 0:dialup_cert:10: signature verification succeeded ike 0:dialup_cert:10: auth verify done ike 0:dialup_cert:10: responder AUTH continuation ike 0:dialup_cert:10: authentication succeeded Related document: Windows IKEv2 native VPN with user certificate