Hello, I'm new to Fortigate but am testing various possible VPN configurations in advance of replacing a Cisco ASA pair with a pair of 600Es. I've tested 2FA (FTM) over SSL - the simplest way. But in the past some techs have requested ipsec remote access vpns. I've tested this using ikev1 along with xauth so that as well as the PSK, a username and password and token are required. Works fine.
But now I'd like to try to do this with ikev2. So my question is: On Fortigate, can you configure a dialup vpn using ikev2 with PSK and require a username and password and token? I've seen documents that seem to hint that this could be done with EAP but I've tried it and debug shows this message so I'm doing something wrong: ike 0:IKEV2-TEST:897: responder received EAP msg ike 0:IKEV2-TEST:897: send EAP message to FNBAM ike 0:IKEV2-TEST:897: initiating EAP authentication ike 0:IKEV2-TEST: EAP user "incs2" ike 0:IKEV2-TEST: EAP failed for user "incs2" ike 0:IKEV2-TEST: EAP response is empty ike 0:IKEV2-TEST: connection expiring due to EAP failure ike 0:IKEV2-TEST: deleting ike 0:IKEV2-TEST: deleted The user incs2 is saved on the client with the right password. On the firewall I have: edit "IKEV2-TEST" set type dynamic set interface "wan1" set ike-version 2 set local-gw 192.168.*.* set peertype any set mode-cfg enable set ipv4-dns-server1 192.168.*.* set ipv4-dns-server2 192.168.*.* set ipv4-dns-server3 192.168.*.* set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256 set dpd on-idle set comments "VPN: IKEV2-TEST (Created by VPN wizard)" set dhgrp 5 set eap enable set eap-identity send-request set ipv4-start-ip 172.29.1.71 set ipv4-end-ip 172.29.1.80 set ipv4-split-include "IKEV2-TEST_split" set save-password enable set psksecret ENC b4L...aXfCE1A== set dpd-retryinterval 60 next end The connection works fine if I remove the EAP settings and disable EAP on the client but I do need to use 2FA - I can always use IKEv1 if this isn't possible. Thanks for your time, Chris.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Managed to get the VPN to connect by adding the authusgrp parameter in the phase 1 interface config but now I need to add 2FA with Fortitoken. Still a problem because it connects without 2FA but won't connect when the user has 2FA configured.
edit "IKEV2-TEST" set type dynamic set interface "wan1" set ike-version 2 set local-gw 192.168.*.* set peertype any set mode-cfg enable set ipv4-dns-server1 192.168.*.* set ipv4-dns-server2 192.168.*.* set ipv4-dns-server3 192.168.*.* set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256 set dpd on-idle set comments "VPN: IKEV2-TEST (Created by VPN wizard)" set dhgrp 5 set eap enable set eap-identity send-request set authusrgrp "ikev2-users" set ipv4-start-ip 172.29.1.71 set ipv4-end-ip 172.29.1.80 set ipv4-split-include "IKEV2-TEST_split" set save-password enable set psksecret ENC +kVfy00FMDsHW8yfu13WjzYqQH0Jkw== set dpd-retryinterval 60
It seems this requires FortIos ver 6.2 for local users and 6.4 for remote users, e.g. radius.
Haven't had time to uograde the box yet but will give it a go next week probably.
I don't know about that 6.2 vrs 6.4 we've used EAP with radius just ensure you use pap is the only gotcha. I wrote a part blog with swanclient but we have deployed NCPclients with EAP.
http://socpuppet.blogspot.com/2018/06/fortios-and-eap-identity-vpn.html
Ken Felix
PCNSE
NSE
StrongSwan
ChrisUNN wrote:Is that a fact? I'm currently seemingly encountering a similar issue, where I can't use EAP with remote LDAP users but local users work (FortiOS 6.0).It seems this requires FortIos ver 6.2 for local users and 6.4 for remote users, e.g. radius.
Haven't had time to uograde the box yet but will give it a go next week probably.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.