FortiClient Autoconnect using Entra - Exclusions or timeout options?

[Zekeout]

Hello,

We have been testing IPsec dialup connections using autoconnect and Entra ID credentials and so far it has worked pretty well. One area of concern is how to exclude situations where we may not want the auto connect to kick off (IE, local admin login or a user login that is not a member of the VPN group).

We are using EMS to configure FortiClient on Windows devices. We have the VPN tunnel configured for auto connect only when off-fabric which covers a majority of these one off situations but is there a better way to exclude users/situations from the auto connection? Maybe something like "stop auto connection after 3 failed attempts"? We have always up max tries set to 3 but this seems to only cover reconnect attempts.

Another thought was creating an additional remote user group on the firewall as a "catch all" group for users who are not members of the defined VPN groups and allow them to establish a vpn connection but  go out the WAN only. Local accounts off-fabric would still get the endless connection failures i would assume.

In the current configuration, logging into Windows using an account that is not a member of the VPN group results in endless connection attempts/failures.

[Jean-Philippe_P]

Hello Zekeout, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

[Jean-Philippe_P]

Hello again Zekeout,

I found this solution. Can you tell me if it helps, please?

To address your concern about excluding certain users or situations from the auto-connect feature for IPsec VPN using Entra ID credentials, you can consider the following approaches:

1. User Group Configuration: Ensure that only the intended user groups are configured for auto-connect in the firewall policies. This can help prevent unauthorized users from triggering the auto-connect feature.
   
   
2. Firewall Policy Adjustments: Create a separate firewall policy for users who are not part of the VPN group. This policy can be configured to allow these users to connect to the internet via WAN without attempting to establish a VPN connection.
   
   
3. EMS Configuration: Use FortiClient EMS to configure specific profiles for different user groups. This allows you to apply different VPN settings based on the user's group membership.
   
   
4. Connection Attempt Limits: While there isn't a direct feature to stop auto-connection after a certain number of failed attempts, you can manage connection attempts through EMS by setting policies that control retry behavior.
   
   
5. Custom Scripts or Automation: Consider using custom scripts or automation tools to monitor connection attempts and take action (e.g., disable auto-connect) if certain conditions are met, such as repeated failures.
   
   
6. Logging and Monitoring: Implement logging and monitoring to track connection attempts and failures. This can help you identify patterns and adjust configurations accordingly.

By combining these strategies, you can better manage and control the auto-connect behavior for different user scenarios.

[Zekeout]

Good Morning,

Thank you for the update. Please see my notes below - I'm not sure that any of these suggestions will fully resolve the issue but they do present opportunities for us to test and see if we can get it working as desired.

User Group Configuration - I'm not aware of any way to disable or exclude user groups from the auto connect configuration using firewall policies. We have user groups assigned to the remote IPsec policies, which controls if the user can/cannot access specific resources post auto-connect, but this does not limit if the auto-connect kicks off or not (a user that is not granted any access via firewall policies would still attempt to auto-connect per the EMS Remote Access policy that is applied to FortiClient but endlessly fail)

Firewall Policy Adjustment: This may work if we create a "catch all" user group as the last lookup and allow outbound WAN access only. That may prevent the endless auto connect failures for uses we don't necessarily want auto connecting to the VPN but is still not ideal because we don't need them connecting to the VPN at all. I assume local accounts would also still run into problems as they are unable to authenticate against Entra.

EMS Configuration - This may be the solution we need but will need to do some testing. Currently, our Endpoint Policies in EMS are only assigned to workstations. Importing AD users into EMS and configuring the policies to check against workstation and user may be the solution if we configure a "catch all" profile at the bottom and don't configure the auto-connect tunnel for that policy.

Connection Attempt Limits - Can you provide any additional information on this? The only connection attempt limits i see in the EMS Remote Profile are related to reconnecting after a connection drops (IE, Always Up Max Tries). From my testing, this only applies after a connection has been established and is then disconnected - does not appear to apply to the initial auto-connect attempt.

Custom Scripts or Automations: We could do something like this but to disable auto-connect we would need to update the endpoint profile based on repeated failures AND then update the endpoint profile again should a valid VPN user login to the workstation which seems cumbersome. Secure Remote Access Tags might be a solution, if we can say "host check fails because user is not a member of the VPN group" and the host check failure warning stops the auto-connection attempts once triggered.

Logging and Monitoring: This is primarily why we want to get the configuration working in a manner that excludes certain users. If we cannot exclude certain users from auto-connecting, logging will get flooded with failed connection attempts and limit our visibility on detecting what is a legitimate threat vs. a user account that is simply logged into a workstation that doesn't have VPN access.

I will do some additional testing with the options you included and see if we can find a valid workaround. Thanks!!

[Jean-Philippe_P]

Hello Zekeout :)

Super, keep us posted of your results then!

Thanks

[Zekeout · Accepted solution]

Hello,

We were able to find a solution to this that works quite well.

1. Create a security posture tag in EMS to check if the current user is a member of an AD group (IE, IPsec_Allow)

2. Enable secure remote access on the remote access profile

3. Configure the autoconnect VPN tunnel to allow access only if the "IPsec_Allow" tag is assigned to endpoint

Users logged in who are not a member of the group will get a single "FortiClient Notification - VPN blocked, please contact IT administrator" pop-up and it blocks the auto-connect from kicking off.

Thanks for the help! 

[Jean-Philippe_P]

Hello Zekeout,

That's awesome! Thanks for sharing the solution for everybody :)

Glad your issue has been fixed!