|
Configuration example:
config vdom
edit root
next
edit Teletrabajo
next
end
config system interface
edit "IPSec-Tele"
set vdom "Teletrabajo"
set type tunnel
set interface "port1"
next
end
config user local
edit "rherreragg"
set type password
set two-factor fortitoken-cloud
set email-to "******@******"
set passwd ENC
next
end
config user group
edit "GG_IPSEC_Pruebas"
set member "rherreragg"
next
end
config vpn ipsec phase1-interface
edit "IPSec-Tele"
set type dynamic
set interface "port1"
set ike-version 2
set local-gw x.x.x.x
set peertype any
set net-device disable
set mode-cfg enable
set proposal aes256-sha256 aes256-sha512
set dhgrp 15
set eap enable
set eap-identity send-request
set ipv4-start-ip 172.26.144.1
set ipv4-end-ip 172.26.159.254
set dns-mode auto
set ipv4-split-include "REDES_IPSEC"
set save-password enable
set psksecret ENC
next
end
config firewall policy
edit <id>
set name "IPSEC_Tele"
set srcintf "IPSec-Tele"
set dstintf "mgmt2"
set action accept
set srcaddr "all"
set dstaddr "Redes"
set schedule "always"
set service "ALL"
set groups "GG_IPSEC_Pruebas"
next
end
Authentication fails due to FCT-Push being sent by FortiGate through the wrong VDOM.
1753117595.629875:
eap_comm_session_add 818 -- comm session added, ses_id=9
1753117595.629998: ep_fnbam_auth_wpa_user 464 -- svc_type='vpn-ikev2-tfa', user='rherreragg', vdom='Teletrabajo', intf='PJHA'
fnbam_add_groups 324 -- Adding user usergroup GG_IPSEC_Pruebas
ep_fnbam_auth_wpa_user 572 -- auth_res=4.
ep_fnbam_auth_wpa_user 592 --auth sess added, ses_id=153940396933126
[1993] handle_req-Rcvd auth_token push req 153940396933126 for eap_proxy
[2000] handle_req-Session to update timeout for ftm push is 1752433496105
[787] __rad_del_job_timer-
[1394] fnbamd_rads_eap_ftk_chal-Extend timer of EAP_PROXY to 60.
[2032] handle_req-Sending autopush msg to FAS, id:153940396933126 user:rherreragg, vdom:root
The debug log shows vd_name of auth request in fnbamd has been 'root', before FortiToken Mobile push is sent to fortitoken-cloud.
Workaround: Switch IPsec tunnel configuration to IKEv1
Fix: Upgrade to v7.6.4, v8.0.0 or above.
Related article:
Technical Tip: Using group based firewall policy for Dial-Up VPN to restrict network access
Technical Tip: Procedure to add multiple user group in XAUTH in dial-up IPsec VPN configuration
|
