Hi all,
At one of my customers I've setup FortiGate SSL VPN with MFA. For MFA we use Azure MFA together with Windows NPS: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension
It's a FortiGate 600E cluster, running on FortiOS 6.4.6. The NPS is a Windows Server 2019.
The setup is working fine with when we use PAP authentication between the FortiGate and the NPS, but because this method is not secure, we want to use MS-CHAPv2 for authentication.
On the FortiGate we have specified MS-CHAP-v2 as authentication method in the RADIUS server settings. MS-CHAPv2 is also enabled on the Connection Request Policy and the Network Policy on our Windows NPS. Unfortunately, authentication is not working.
When we try to connect the SSL VPN, the FortiClient gives the following errror: credential or ssl vpn configuration is wrong (-7200). The RADIUS requests are arriving at our NPS but the NPS event logs don't give me any usefull information.
I already tried switchting between MS-CHAPv2, MS-CHAP and CHAP, but none of them are working. Authentication is only working with PAP.
Is someone familiar with this kind of setup?
Thanks!
Best regards,
Jorg
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi Jorge
I have same problem. Did you get reply to how to fix this issue ?
Thanks
This might help
By default the RADIUS client on the FortiGate is set to auto negotiate the auth type and will try PAP, MSCHAPv2, and then CHAP in that order, and use the first one it finds (don’t ask me why it is in that order). You can either force it to only use MSCHAPv2 on the FortiGate side, or disable PAP as an auth method in the network policy on NPS and it should negotiate to something else. See auth-type options in the CLI https://docs.fortinet.com/document/fortigate/7.0.1/cli-reference/496620/config-user-radius
# set auth-type
auto Use PAP, MSCHAP_v2, and CHAP (in that order).
ms_chap_v2 Microsoft Challenge Handshake Authentication Protocol version 2.
ms_chap Microsoft Challenge Handshake Authentication Protocol.
chap Challenge Handshake Authentication Protocol.
pap Password Authentication Protocol.
This is a great reference Raymon, but it doesn't work for me, unfortunately. I configured the ms_chap_v2 via CLI, but the Event log on the RADIUS Server still getting that the authentication type is PAP.
Firewall 6.0.4
config user radius
edit "SRVRD01"
set server "192.168.x.x"
set secret "keep secret"
set auth-type ms_chap_v2
set source-ip "192.168.x.x"
next
MS RADIUS Event: Authentication Type: PAP
May be this can help?
If you must use MS-CHAPv2, you can enable NTLMv2 authentication by adding this registry entry:
Thanks,
SG
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1561 | |
1034 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.