2FA SSL VPN with LDAP authentication

[Navs1818]

Hi all, i have a HA (active passive) pair of 100E fortigate firewalls and want to enable 2FA for SSL VPN.

Current Setup

We use LDAP auth, with any users in a specific AD group allowed to VPN in, saves us having to create individual users on the firewall.

2FA Setup

Two me it appears i can use either Fortitokens or a Certificate for 2FA, but from reading and testing it appears that for both methods i need to create local users mapped to LDAP users on the firewall. Then i can either apply a token or a cert to each user (LDAP or PKI), is my understanding correct?

Is there any way to enable 2FA without the need to create individual users on the firewall?

Thanks

[sw2090]

afair the Fortigates do support radius usergroups so you don't need to create the users here. Alas in this case the 2FA has to be done by the radius. We do it this way with IPSec VPN using a FortiAuthenticator for radius auth on it using radius usergroups from the FAC which are filled with users the FAC imports from AD Usergroups. FAC also provides FortiTokens as 2FA here.

[Navs1818]

Unfortunately, we don't use a FAC. I assume there is no way to sync LDAP users belonging to a specific AD group into the fortigate itself?

[sw2090]

hm I assume that then you will need to use the FGT's AD Connector for authenticating against AD. 2FA then might force you to create radius users on the FGT to be able to add a cert or token to the user.

[hbac]

Hi @Navs1818,

Yes, you need to create each local user otherwise, you won't be able to assign FortiToken to each user. You can consider using SAML or DUO MFA.

Regards, 

[Navs1818]

Hi, I looked into SAML with M365 and this looks like the best option, no need to pay extra for tokens and can use Azure groups to manage access. One question though.

If i add the SAML configuration alongside my current SSL VPN config which is based on LDAP user groups, will the current SSL VPN break or can the two run alongside each other whilst i test? i can't see why they couldn't run alongside each i want to check first.

[pminarik]

SAML and non-SAML (LDAP, RADIUS, ...) use different auth-flows, so they should not compete and cause breakage like LDAP vs RADIUS potentially can.

The only tricky part to watch out for is if you're using source-interface/-address restrictions in portal mappings (user/group -> portalX), make sure to apply those to the new SAML mappings as well (CLI only: config vpn ssl setting -> config authentication-rule).

[Navs1818]

Looks like the other option is to use Forticloud tokens, you can sync users in a particular AD group into forticloud and it will then assign a token, but it has an annual cost.