FortiClient IPSec-over-TCP - LDAP Users with email 2FA

[FortiDor]

Hello,

Is it possible to setup a email 2FA for LDAP users to protect the VPN IPSec-overs-TCP connection ? 
The feature is working fine in the SSL VPN as previously.

I found this KB but meaning working with a Certificat authentication : 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-email-based-MFA-with-certificate/ta-...

My IPSec-over-TCP is working with a pre-shared key.

Thanks

[sjoshi]

Yes it is possible.

You need to import the ldap user on the fortigate to assign 2fa

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Importing-LDAP-user-and-applying-two-facto...

[FortiDor]

Hello @sjoshi 

Already done but not working with the IPsec VPN instead of SSLVPN

Here is the information find in the ike log : 

> ike V=root:0:IPsec-TCP: EAP succeeded for user "xxx" group "XXX" 2FA=no

But in the user CLI setting : 

> config user local
edit "xxx"
set type ldap
set two-factor email
set email-to "xxx"
set ldap-server "COMMUN-AD"
next
end

Any information ?

[sjoshi]

can you show me the group config.

config user group

edit XXX

show

[FortiDor]

Hi,

config user group
edit "GROUP"
set group-type firewall
set authtimeout 0
set auth-concurrent-override disable
set http-digest-realm ''
set member "XXX"
next
end