Dial-UP VPN

[FG_User2]

Hello, We have virtual Fortigate Deployed in VMWARE, We are trying to configure Dial-up VPN with cert authentication, but we get "XAUTH authentication failed" error, also in debug we see "fnbamd_cert_auth_copy_cert_status-Leaf cert status is unchecked"

What it can be and how fix? 

[pminarik]

I don't see any users/groups shown in that snippet, so presumably that is not enough.

[FG_User2]

Thanks @pminarik When I selected group in policy I can connect. But when I select wrong certificate I can connect anyway... 

Is user peer configuration correct? 

config user peer
edit "ldap-peer"
set mandatory-ca-verify enable
set ca "CA_Cert_2"
set subject ''
set cn ''
set cn-type string
set ldap-server "DC01"
set ldap-mode principal-name
set ocsp-override-server ''
set two-factor disable

[pminarik]

Alright, so the XAUTH error shown initially was expected. :)
You must have some user/group included in either the firewall policies, or in phase1 config, as noted.

For the certificate: Can you define what precisely you mean by "wrong certificate"?
As it is configured now, the only check is:
- issued by CA "CA_Cert_2"
- the username included in the certificate exists in AD and is not a disabled user

- + usual checks (not expired, etc.)

No other restrictions are configured.

[FG_User2]

Thanks for your reply @pminarik 
Self-Signed certificate was selected as source, which was not signed by CA_Cert_2, but client could connect 

[pminarik]

If true, that would suggest a bug. In that case my recommendation is to open a support ticket with TAC to get things double-checked, and fixed if confirmed as not working as expected.

(you can also share the ike + fnbamd outputs (similar as before)of the test with a self-signed cert here if you'd like a preliminary check :) )