Dial-Up VPN with TOTPRadius Authentication – Does It Work?

[MG4]

Hey everyone,

I recently attempted to set up Dial-Up VPN authentication using TOTPRadius in combination with an LDAP server and TOTP (Time-Based One-Time Password). TOTPRadius acts as a Proxy-RADIUS server and integrates LDAP authentication with TOTP for two-factor authentication.

The setup process was based on the information provided by Token2's guide, which primarily explains how to configure TOTPRadius for admin login but does not explicitly mention VPN authentication. The Test Authentication worked, but when in combination with VPN it doesn't.

The Problem:

When trying to authenticate a Dial-Up VPN client using FortiGate and TOTPRadius, the authentication fails with the following error message from the TOTPRadius Server shown in Wireshark:

Initial login not allowed; Empty password provided for user <blank-user>; Terminating process with Reject message

This suggests that the FortiGate did not transmit the user’s password when performing VPN RADIUS authentication.

[MG4]

The VPN does work when I use a normal RADIUS server such as NPS (Microsoft's own RADIUS).

[Hhev1]

NPS works with one step authentication, but TOTPRadius needs to decode the password to extract OTP from it .

[Hhev1]

Try with authentication type set as PAP
As TOTPradius needs to split the password, other methods may not work

[MG4]

Yeah, only PAP or "Default" works. Other authentication methods don't work.

[AEK]

Thanks Hev, actually I don't know TOTPradius, but you seem to know it well and what you said makes sense.

[AEK]

So if I understand well with this PAP config you just need to concatenate your TOTP with the password, and it should work well.

[Hhev1]

Exactly 

[MG4 · Accepted solution]

IKEv2 does not allow for PAP authentication by design...

I wish I had done my research before this post, but as the above says, IKEv2 does not allow for PAP authentication. Since TOTPRadius uses PAP as a Proxy-RADIUS to simply cut the password part and the TOTP part, for the authentication. Which means you either use IKEv1 (which has been deemed depreacted and unsafe since 2019 from the IETF https://datatracker.ietf.org/doc/rfc9395/ ) or just don't.

[AEK]

If you don't have FortiAuthenticator then you can try FreeRadius. It is a very powerful RADIUS server and as far as I know it supports MS-CHAP-v2.

[MG4]

Hi AEK,

I wanted an authentication method using YubiKey without having to purchase an appliance for just 5–10 users. At first, TOTPRadius seemed like a great option, but it no longer does.

On the bright side, I finally figured out how to use certificate authentication with smartcards on FortiGate and LDAPS behind the scenes. So at least I have an alternative solution for my other issue. I guess I was too fixated on LANCOM’s VPN client not being able to read smartcards like the YubiKey, whereas FortiClient works perfectly.