IPsec IKEv2 Dialup using LDAP Machine Cert authentication

[FortiNet_Newb]

I have been making no progress on this for weeks now.  Using FortiClient 7.4.4 I am unable to successfully configure an IPsec IKEv2 remote VPN connection using LDAP machine certificate (not a user certificate) authentication.  We have an internal Windows CA.  All clients have a Machine certificate issued by our internal CA with an EKU for Client Authentication and the FQDN set in the certs subject name (ex:  CN= ComputerName, OU=Computers, DC=domainname, DC=local) in their local computer personal store.  All client machines also have our internal CA’s root certificate in their local computer Trusted Toot Certification Authority store.  The FortiGate has a server certificate installed that was issued from our internal CA (appears properly in the FG Local Certificate store) and it also has our internal CA’s root certificate (appears properly in the FG Remote Certificate store).

All of the Certificates mentioned above are still valid and not expired.

The machine certs currently work when used to connect to our current SSL VPN and also for our WiFi, further indicating that the machine certificates are valid and should work with the IPsec VPN.

When trying to connect I get a “ CertificateSignFailed” error message in FortiClient.

If I use a user certificate for authentication with the IPsec IKEv2 VPN instead of the machine cert, it connects with out issue.  This indicates to me that the other certificates in the chain are valid.

There has got to be a configuration setting that I am missing to get this VPN to work using machine certs, but for the life of me I can not find it.  All of the documentation I have come across for IPsec IKEv2 configurations is for user certs.

I also can’t find any known issues related to IPsec LDAP machine certificate authentication.  Can anyone post a basic working config that I can try.  I would like to use this to enable pre-Windows logon authentication.

Thanks in advance.

[funkylicious]

hi,

have you gone through 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IKEv2-dial-up-VPN-with-LDAP-and-Certificat...

https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/432323/cross-validation-for-...

https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/298520/ipsec-ikev2-vpn-2fa-w... 

[FortiNet_Newb]

@funkylicious, 

Yes, I've gone through each and have am still unsuccessful.  To make it easy, my computer certs include their User Principal Name in the SAN field of the certificate, as that seems to be what the FG expects as a default.  I've also tried configuring the FG to compare with the dns name or the  cn names instead and get the same result.

[funkylicious]

hi,

this is my working IPsec IKEv2 with LDAP user and client cert I tested

LAB-IT (root) # show user ldap
    edit "LAB-AD-LDAPS"
        set server "192.168.200.201"
        set server-identity-check disable
        set cnid "sAMAccountName"
        set dn "dc=lab"
        set type regular
        set username "LAB\\labadmin"
        set password <>
        set secure ldaps
        set ca-cert "root-LAB"
        set port 636
    next
end

LAB-IT (root) # show user peer
config user peer
    edit "LAB-pki"
        set ca "root-LAB"
        set mfa-mode subject-identity
        set mfa-server "LAB-AD-LDAPS"
    next
end

LAB-IT (root) # show user peergrp
config user peergrp
    edit "LAB-pki-grp"
        set member "LAB-pki"
    next
end


LAB-IT (root) # show vpn ipsec phase1-interface
config vpn ipsec phase1-interface
    edit "RA-cert"
        set type dynamic
        set interface "wan1"
        set ike-version 2
        set authmethod signature
        set peertype peergrp
        set net-device disable
        set mode-cfg enable
        set proposal aes128-sha256 aes256-sha256
        set dpd on-idle
        set dhgrp 14
        set eap enable
        set eap-identity send-request
        set eap-cert-auth enable
        set network-overlay enable
        set network-id 1
        set certificate "LAB-FGT"
        set peergrp "LAB-pki-grp"
        set assign-ip-from name
        set ipv4-split-include "DialUP_split"
        set ipv4-name "IPsec-cert_range"
        set save-password enable
        set dpd-retryinterval 60
    next
end

After connecting:

LAB-IT (root) # diagnose vpn ike gateway list

vd: root/0
name: RA-cert_0
version: 2
interface: wan1 17
addr: IPsec-WAN:4500 -> USER-WAN:64917
tun_id: 10.0.2.50/::10.0.0.18
remote_location: 0.0.0.0
network-id: 1
transport: UDP
created: 18s ago
eap-user: myname
groups:
  RA-cert-grp 6
peer-id: DC = lab, OU = LAB-Users, CN = My Name
peer-id-auth: yes
FortiClient UID: 3FC3FE2517A34882BA1BABB6C9B5C50D
assigned IPv4 address: 10.0.2.50/255.255.255.255
nat: peer
IKE SA: created 1/1  established 1/1  time 90/90/90 ms
IPsec SA: created 1/1  established 1/1  time 0/0/0 ms

  id/spi: 112 ba34d2c8c634f3f9/ee39ce955c3482be
  direction: responder
  status: established 18-18s ago = 90ms
  proposal: aes128-sha256
  lifetime/rekey: 86400/86111
  DPD sent/recv: 00000000/00000000
  peer-id: DC = lab, OU = LAB-Users, CN = My Name
  peer-group: LAB-pki-grp

I am using EMS 7.4.4 and FCT 7.4.3 IKEv2 w/ EAP-TTLS and network id ( i have another IKEv2 tunnel configured, to diff them ) but I think IKEv1 will also work.

My cert configured and signed by the CA is installed in Personal ( if you generate it somewhere else and import it you must also have the private key - pfx file ) and on the FGT i've created a CSR and signed it by the same CA ( root-LAB ) then imported it ( LAB-FGT ).

Hope it helps.

L.E. computer certificate also works,  if you unset mfa-mode / mfa-server otherwise, it will fail with :

ike V=root:0:RA-cert:149: fnbam cert group matching failed
ike V=root:0:RA-cert:149: certificate validation failed
ike V=root:0:RA-cert:149: certificate validation before eap failed
ike V=root:0:RA-cert:149: auth verify done
ike V=root:0:RA-cert:149: responder AUTH continuation
ike V=root:0:RA-cert:149: authentication failed