Certain settings not available in ipsec dialup, why?

[scheuri1]

Hi all

I am trying to setup a ipsec dialup (to replace SSL VPN) on a FGT200G running 7.4.8, and I am using FortiClient (VPN-Only, free version) with 7.4.3.

As for authentication, I want to start out with local user (without MFA). Once this works I am going to try with Radius (users on FAC with and without FTM) and from there to SAML.

I would like to use a specific interface and a specific (public) IP on said interface (to distinguish that dialup from other dialups).
Preferably, I would like to use peerid's (if possible, but I guess that depends?).
Additionally, I would like to use a PSK. So that the client needs that before connection and getting to any kind of user authentication with username/password (and potential MFA), if that is possible.
(As for split-tunneling and full tunnel, I will try and play around with this, once the first configuration snippet works)

The internet is full of examples (officially from Fortinet as well as from all you experts). Unfortunately, I am hitting issues I can't wrap my head around.

I set the ike-tcp-port to 443 in the system global settings.

Then I tried to add the following phase1-interface config:

config vpn ipsec phase1-interface
    edit "du_ras1"
        set type dynamic
        set interface "x1"
        set ike-version 2
        set local-gw <one of my public IPs on the interface>
        set mode-cfg enable
        set proposal aes256-sha256
        #set peertype one
        set dhgrp 21
        set dpd on-idle
        set dpd-retryinterval 10
        set authmethod psk
        #set psksecret "testtest"
        set eap enable
        #set usrgrp "du_ras_local-group"
        set ipv4-start-ip 10.206.0.240
        set ipv4-end-ip 10.206.0.250
        set ipv4-netmask 255.255.255.0
        #set peerid "rasuser1"
    next
end

The hash-tagged parts are not available all the time and with all combinations:

• If I choose "peertype one" (to set a specific peerid), then I can add "peerid" and "psksecret", however, I can't add "usrgrp" (which to my knowledge is needed for user auth). There seems to be no "xauthtype" and no "authusrgrp" available.
• If I choose "peertype dialup", then I can add "usrgrp", I cannot add "peerid" or "psksecret".

(Refering to the example of https://docs.fortinet.com/document/fortigate/7.4.8/administration-guide/785501).

1. Is it possible that using "peertype one" (with peerid and psksecret) only makes sense when using SAML and RADIUS authentication?
2. While using "peertype dialup" (without peerid and without psksecret) only makes sense when authentication is done locally on the FGT?

Thank you for all your assistance.

[funkylicious]

have a look at https://docs.fortinet.com/document/fortigate/7.6.0/ssl-vpn-to-ipsec-vpn-migration/126460 

[scheuri1]

Thank you very much - I was looking at https://docs.fortinet.com/document/fortigate/7.4.4/ssl-vpn-to-ipsec-vpn-migration/126460/ (as we are using 7.4.x).

If you are refering to the peer-id situation, then the 7.6.0 documentation is more detailed - see particularly https://docs.fortinet.com/document/fortigate/7.6.0/ssl-vpn-to-ipsec-vpn-migration/690046/customizing... where it says that IKEv2 has limited peerid functionality. 

And with the documentation https://docs.fortinet.com/document/fortigate/7.4.4/ssl-vpn-to-ipsec-vpn-migration/126460/ in the parts of the vpn wizard, I was missing the possibility to set a specific public IP on the interface (as I am using several public on the same interface and several dial-ups on said interface) - so I never tried it out to make sure I am not breaking anything just yet.

[sw2090]

Are you sure they do not exist?
It doesn't make sense to me. Psk i the first auth that is done upon establishing the vpn. So it should always be available. 

I do have arious ipsec dial up vpn even with radius auth here. And all of them do have a psk secret and they are limitied to one specific peer id.

I only have all that in 7.2  so cannot speak about 7.4.

[dingjerry_FTNT]

Hi @scheuri1  ,

You are using IKEv2, FortiOS 7.4.8.

My FGT is running FortiOS 7.4.5.

1) IKEv2 + Type / Static:

(phase1-interface) # edit test
new entry 'test' added

(test) # set type static

(test) # set ike-version 2

(test) # set peertype
any Accept any peer ID.

(test) # set authmethod
psk PSK authentication method.
signature Signature authentication method.

There is no user group configuration setting. But you can still use "psk" method.

2) IKEv2 + Type / Dynamic:

(test) # set peertype
any Accept any peer ID.
one Accept this peer ID.
dialup Accept peer ID in dialup group.

(test) # set peertype dialup
(test) # set authmethod
psk PSK authentication method.
signature Signature authentication method.

(test) # set usrgrp
<string> please input string value
Guest-group group
Home_User_Group group

There is the "usrgrp" setting for you to choose a user group to authenticate the remote dialup clients.