Forinet, Freeradius and certificate autentication

[Lelle68]

Hi all,

I'm not a Fortigate or Freeradius expert by any means but I usually manage to do things if I get some notes how to do things.

I would like to accomplish the following.

Part 1

Authenticate windows 11 native ipsec vpn users with certificates (EAP-TLS)

Firewall is Fortigate with 7.2.7 firmware

Remote user ipsec vpn with certificates, users are stored in LDAP (Not AD) directory, certificates contain e-mail address and cn.

Freeradius is used as Radius server, connected to LDAP Backend, want to use that LDPA server to verify certificate and return authenticated/not authenticated.

Part 2

WPA2 authentication for windows 11 users with certificates (EAP-TLS)

Wireless authentication for primary Windows 11 users, Fortinet Access Points connected to Freeradius server via Fortigate Firewall.

Part 3

802.1X authentication for wired clients, Fortinet Switches connected to Fortigate firewall and Freeradius server.

There are lots of playbooks for doing this with Windows AD and Windows NPS server, but not so much for Freeradius.

I suppose that there are people that has done this before and could share pointers how to get it to work.

I know that it probably would be easier to setup with Fortinet Radius or NPS, but I don’t have that so I have to work with what I got

Thanks in advance

Lennart

[Jean-Philippe_P]

Hello Lelle68, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

[Markus_M]

Hi Lelle68,

freeradius may not be covered well here, simply because we don't do much with direct configuration.

I suggest you check the freeradius forums/documentation directly:

https://www.freeradius.org/documentation/freeradius-server/4.0.0/tutorials/eap-tls.html

EAP-TLS itself is only a protocol, encapsulated in RADIUS and the server won't really care what the use case of the end user is (IPSec/WPA2/Wired-EAP-auth).

It will respond, and both server AND client MUST trust the certificate that the other node sends. So the RADIUS server must trust the client certificate and have the issuer added to its trusted root CA store. Conversely, the client must trust what the server sends in the TLS exchange.

Keep also in mind that user and computer/machine authentication also do not matter much.

- The client must be set up to sent the correct certificate to authenticate

- The RADIUS server likewise will receive a certificate via RADIUS and then evaluate it. Whether host/laptop123 or user123 is part of the subject is solely up to the RADIUS server configuration to read/map.

Documentation on the FortiGate part and your questions:

1) https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/726232/windows-ikev2-native-...

2) https://docs.fortinet.com/document/fortiauthenticator/5.5.0/cookbook/653067/configuring-the-fortiwif... (the FortiGate part)

3) https://docs.fortinet.com/document/fortiauthenticator/5.5.0/cookbook/999322/configuring-the-switch (the switch part)

A bit more detail on how to configure the Windows side is found here:
https://community.fortinet.com/t5/FortiSwitch/Technical-Tip-How-to-use-FortiSwitch-to-authenticate-u...

Best regards,

Markus