Active Directory users on IPsec VPNs with 2FA

[damianhlozano]

Hello team!

Is there a way to create VPN ipsec which could use domain users (AD) and use 2FA for each user?

In this case, is there a way to use 2FA through email?

I think, to configure a different 2FA for each user, these users should be in Fortigate, but I ask just in case that there is anything else that I cant see.

If not, do you know any other VPN which would allow this? 

Is this possible with ZTNA? (I am still very noob with ZTNA), in this case I will need to learn more

Thanks in advance.

Regards,

Damián

[AnthonyH]

Hello damianhlozano,

I do not believe I done this, but you can try:
1) Creating the IPsec Dialup VPN.
2) Configure the FortiGate and connect it to your LDAP server. https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-FortiGate-to-use-an-LDAP-...
3) Configure the user for 2FA in CLI: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Email-Two-Factor-Authentication-on-FortiGa...

[vbandha]

Hi @damianhlozano ,

Regarding your query "I think, to configure a different 2FA for each user, these users should be in Fortigate, but I ask just in case that there is anything else that I cant see."

Well they are not strictly in fortigate. What I mean is you don't need to create local user, you can create a ldap user. You are still creating individual user but the authentication happens with ldap:

Here is an article related to that:

https://community.fortinet.com/t5/FortiGate/Technical-Note-Configuring-Remote-LDAP-users-with-Two-Fa...

You can create the ldap user and then follow same steps to configure 2fa with email like local user:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Email-Two-Factor-Authentication-on-FortiGa...

Regards,

Varun

[damianhlozano]

Thank you vbandha and AnthonyH!

Now I know how to create IPsec DialUp VPN with LDAP authentication and 2FA

Anyway, I should have remote ldap users in the Fortigate, and if some user is added to AD, should be added to the Fortigate to.

Is there a way to apply the 2FA to AD and make Fortigate to know this?

I mean, if Fortigate does not know that AD has 2FA, FortiClient will never ask for the 2FA code.

¿Do you know if is this possible with ZTNA?

Thanks

Regards,

Damián

[pminarik]

If you're using the template/wizard dialup IPsec for remote FortiClients, this will be IKEv1 with XAUTH. 2FA is easy with this, it will be just two XAUTH exchanges (password, then OTP) during mode-config exchange after phase1 is established.

This can be done with remote LDAP server, and individual users imported into the FortiGate with FortiTokens individually assigned to them. For a solution more manageable at scale, you would want either FortiAuthenticator (to manage & (auto-)assign the tokens to users), or FortiToken-Cloud (can do automated token assigment to an entire OU in the LDAP tree).

[damianhlozano]

Thanks pminarik,

I will try this the next week.

Regards,

Damián

[damianhlozano]

Sorry about the delay,

Now, we have a contract for 1 Year coverage for FortiClient EMS Cloud. (Someone bought his, I dont know why)

Is this possible to accomplish this, with this contract or I will need FortiAuthenticator / FortiToken-Cloud?

* Group of AD users, can connect to VPN

* Users have 2FA

* User are only in AD, no need to add all users locally on Fortigate or FortiClient EMS

Thanks in advance.

Regards,

Damián

[pminarik]

The type of EMS (on-prem, Cloud) does not affect this scenario.

VPN with 2FA and AD as user database can be set up even with free version of FortiClient.

If you want to avoid importing individual AD users to the FortiGate and manually assigning them tokens for 2FA, you will need something like FortiAuthenticator (on-prem, in cloud, anywhere), or FortiToken-Cloud.

[damianhlozano]

Thanks a lot, pminarik!!

Now, the last question, sorry.

Is this possible with ZTNA VPNs:

* Group of AD/Azure users, can connect to VPN

* Users have 2FA

* User are only in AD/Azure, no need to add all users locally on Fortigate or FortiClient EMS

Thanks.

Regards!

Damián

[pminarik]

The ZTNA-license-type for EMS/FortiClient is enough for any VPN functionality.

ZTNA-based conditional access for VPN users is optional, and available.

If Azure/Entra is avaliable, that may be an interesting option. You could use SAML for authentication, and handle 2FA on the IdP (Azure side). The FortiGate will then only need some group definitions, no user importing or 2FA assignment there.

For on-prem AD (~LDAP, or RADIUS), you would need to decide where you want the 2FA assignments done and provisioned to users. (FortiAuthenticator, FTK-Cloud are options as mentioned already; or any 3rd party that can do something similar)