Help setting up Fortigate IPSEC VPN with Microsoft MFA

[RF2]

Hello,

We have a customer currently using IPSEC VPN using a pre shared key. The users sign-in using their on-prem AD username and password. We have ADSync setup sync the accounts to Microsoft 365 and the PC’s are hybird joined. The customer would like to start using Microsoft MFA to authenticate the VPN. I can’t seem to find a step by step guide to set this up has anyone setup this that can provide information on how to set it up correctly? Ideally I want to keep the current IPSEC setup but just add Microsoft MFA to authenticate.

[Dhruvin_patel]

Greetings!

To set up Microsoft MFA for authentication on the existing IPSec VPN using a pre-shared key with on-premise AD synced to Microsoft 365, you can follow these steps:

1. Ensure Prerequisites:
- Confirm that your on-premise AD is synced to Microsoft 365 using AD Connect.
- Make sure your PCs are hybrid joined to Azure AD.

2. Configure Microsoft NPS:
- Install and configure Network Policy Server (NPS) on your on-premise server.
- Add a RADIUS client for your FortiGate IP address with a shared secret.

3. Enable EAP on FortiGate:
- Since XAUTH is not present for IKEv2, enable EAP on FortiGate for user group selection.

4. Configure RADIUS Server on FortiGate:
- Set up the RADIUS server on FortiGate with the NPS server details.

5. Enable MFA for Users:
- In Azure portal, go to Azure Active Directory > Users > Multi-Factor Authentication.
- Enable MFA for the users who will be authenticating for VPN access.

6. Test the Configuration:
- Test the VPN connection using FortiClient with a user account that has MFA enabled.
- Verify that the authentication process prompts for MFA verification after entering the AD username and password.

Following these steps, you can integrate Microsoft MFA for authentication on the existing IPSec VPN setup while keeping the current configuration with a pre-shared key.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IKEv2-Dialup-IPsec-tunnel-with-Radius-and/...

https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/azure-administration-guide/517582/co...

Best Regards!

If you have found a solution, please like and accept it to make it easily accessible for others.

[RF2]

Hi Dhruvin Patel,

The customer already has radius setup for their WiFi will this affect that? They also have LDAP Servers setup can i use that group when setting this up? Also do i need purchase FortiToken's for this to work?

[RF2]

Could i set this up? How to configure Microsoft Entra ID SAML ... - Fortinet Community

[AEK]

Hi RF2

I think you should integrate MS MFA to the RADIUS server that is used by IPsec VPN as authentication server.

You don't need for FortiTokens since you already use MS MFA.

[RF2]

Hi AEK,

Thanks for your reply. Is radius server the only solution here? As the customer is already using IPSEC VPN with LDAP enabled.

[AEK]

Hi RF2

Honestly I don't know if LDAP authentication offers MFA like RADIUS.

Hope some LDAP-experienced member can help on that.