IPsec IKEv2 Dialup using LDAP Machine Cert authentication

[FortiNet_Newb]

I have been making no progress on this for weeks now.  Using FortiClient 7.4.4 I am unable to successfully configure an IPsec IKEv2 remote VPN connection using LDAP machine certificate (not a user certificate) authentication.  We have an internal Windows CA.  All clients have a Machine certificate issued by our internal CA with an EKU for Client Authentication and the FQDN set in the certs subject name (ex:  CN= ComputerName, OU=Computers, DC=domainname, DC=local) in their local computer personal store.  All client machines also have our internal CA’s root certificate in their local computer Trusted Toot Certification Authority store.  The FortiGate has a server certificate installed that was issued from our internal CA (appears properly in the FG Local Certificate store) and it also has our internal CA’s root certificate (appears properly in the FG Remote Certificate store).

All of the Certificates mentioned above are still valid and not expired.

The machine certs currently work when used to connect to our current SSL VPN and also for our WiFi, further indicating that the machine certificates are valid and should work with the IPsec VPN.

When trying to connect I get a “ CertificateSignFailed” error message in FortiClient.

If I use a user certificate for authentication with the IPsec IKEv2 VPN instead of the machine cert, it connects with out issue.  This indicates to me that the other certificates in the chain are valid.

There has got to be a configuration setting that I am missing to get this VPN to work using machine certs, but for the life of me I can not find it.  All of the documentation I have come across for IPsec IKEv2 configurations is for user certs.

I also can’t find any known issues related to IPsec LDAP machine certificate authentication.  Can anyone post a basic working config that I can try.  I would like to use this to enable pre-Windows logon authentication.

Thanks in advance.

[FortiNet_Newb]

I tried posting the debugs, but every time I include the debug this forum does not accept the post (even though it looks like it goes through).

[funkylicious]

try putting it as code sample ( </> symbol ) , like i did my config above.

[FortiNet_Newb]

Below are my IKE Debugs:

My_FortiGate # ike V=root:0: comes 192.168.1.100:59785->999.999.999.999:4500,ifindex=47,vrf=0,len=626....
ike V=root:0: IKEv2 exchange=SA_INIT id=4e4531924d116d66/0000000000000000 len=622
ike 0: in 4E4531924D116D66000000000000000021202208000000000000026E2200008C0200004401010007030000080300000C0300000C0100000C800E0080030000080400000E03000008020000050300000802000006030000080200000700000008020000020000004402010007030000080300000C0300000C0100000C800E0100030000080400000E030000080200000503000008020000060300000802000007000000080200000228000108000E000098E83F52D……
ike V=root:0:4e4531924d116d66/0000000000000000:286: responder received SA_INIT msg
ike V=root:0:4e4531924d116d66/0000000000000000:286: VID forticlient connect license 4C53427B6D465D1B337BB755A37A7FEF58E4BA13F67F0000
ike V=root:0:4e4531924d116d66/0000000000000000:286: VID Fortinet Endpoint Control B4F01CA951E9DA8D0BAFBBD34AD3044E78E4BA13F67F0000
ike V=root:0:4e4531924d116d66/0000000000000000:286: VID Forticlient EAP Extension C1DC4350476B98A429B91781914CA43E28EB3A1A32000000
ike V=root:0:4e4531924d116d66/0000000000000000:286: received notify type NAT_DETECTION_SOURCE_IP
ike V=root:0:4e4531924d116d66/0000000000000000:286: received notify type NAT_DETECTION_DESTINATION_IP
ike V=root:0:4e4531924d116d66/0000000000000000:286: received notify type SIGNATURE_HASH_ALGORITHMS
ike V=root:0:4e4531924d116d66/0000000000000000:286: incoming proposal:
ike V=root:0:4e4531924d116d66/0000000000000000:286: proposal id = 1:
ike V=root:0:4e4531924d116d66/0000000000000000:286:   protocol = IKEv2:
ike V=root:0:4e4531924d116d66/0000000000000000:286:      encapsulation = IKEv2/none
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=ENCR, val=AES_CBC (key_len = 128)
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=INTEGR, val=AUTH_HMAC_SHA2_256_128
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=PRF, val=PRF_HMAC_SHA
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=PRF, val=PRF_HMAC_SHA2_512
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=PRF, val=PRF_HMAC_SHA2_384
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=PRF, val=PRF_HMAC_SHA2_256
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=DH_GROUP, val=MODP2048.
ike V=root:0:4e4531924d116d66/0000000000000000:286: proposal id = 2:
ike V=root:0:4e4531924d116d66/0000000000000000:286:   protocol = IKEv2:
ike V=root:0:4e4531924d116d66/0000000000000000:286:      encapsulation = IKEv2/none
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=ENCR, val=AES_CBC (key_len = 256)
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=INTEGR, val=AUTH_HMAC_SHA2_256_128
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=PRF, val=PRF_HMAC_SHA
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=PRF, val=PRF_HMAC_SHA2_512
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=PRF, val=PRF_HMAC_SHA2_384
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=PRF, val=PRF_HMAC_SHA2_256
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=DH_GROUP, val=MODP2048.
ike V=root:0:4e4531924d116d66/0000000000000000:286: matched proposal id 1
ike V=root:0:4e4531924d116d66/0000000000000000:286: proposal id = 1:
ike V=root:0:4e4531924d116d66/0000000000000000:286:   protocol = IKEv2:
ike V=root:0:4e4531924d116d66/0000000000000000:286:      encapsulation = IKEv2/none
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=ENCR, val=AES_CBC (key_len = 128)
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=INTEGR, val=AUTH_HMAC_SHA2_256_128
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=PRF, val=PRF_HMAC_SHA2_256
ike V=root:0:4e4531924d116d66/0000000000000000:286:         type=DH_GROUP, val=MODP2048.
ike V=root:0:4e4531924d116d66/0000000000000000:286: lifetime=86400
ike V=root:0:4e4531924d116d66/0000000000000000:286: SA proposal chosen, matched gateway My-IPsec-VPN
ike V=root:0:My-IPsec-VPN:My-IPsec-VPN: created connection: 0x5561008c30 47 999.999.999.999->192.168.1.100:59785.
ike V=root:0:My-IPsec-VPN:286: processing notify type NAT_DETECTION_SOURCE_IP
ike V=root:0:My-IPsec-VPN:286: processing NAT-D payload
ike V=root:0:My-IPsec-VPN:286: NAT detected: PEER
ike V=root:0:My-IPsec-VPN:286: process NAT-D
ike V=root:0:My-IPsec-VPN:286: processing notify type NAT_DETECTION_DESTINATION_IP
ike V=root:0:My-IPsec-VPN:286: processing NAT-D payload
ike V=root:0:My-IPsec-VPN:286: NAT detected: ME PEER
ike V=root:0:My-IPsec-VPN:286: process NAT-D
ike V=root:0:My-IPsec-VPN:286: processing notify type SIGNATURE_HASH_ALGORITHMS
ike V=root:0:My-IPsec-VPN:286: FEC vendor ID received FEC but IP not set
ike 0:My-IPsec-VPN:286: FCT EAP 2FA extension vendor ID received
ike V=root:0:My-IPsec-VPN:286: responder preparing SA_INIT msg
ike V=root:0:My-IPsec-VPN:286: create NAT-D hash local 999.999.999.999/4500 remote 192.168.1.100/59785
ike V=root:0:My-IPsec-VPN:286: sending CERTREQ payload (len=21)
ike V=root:0:My-IPsec-VPN:286: certreq[0]: 'DE611F4514795A658F3A617E24A17292045C506A'
ike 0:My-IPsec-VPN:286: out 4E4531924D116D6636CC22DE3413CF572120222000000000000001B9220000300000002C010100040300000C0100000C800E00800300000802000005030000080300000C000000080400000E28000108000E000084E1D1ECDF56AF02AEA3C210056CB29FEDD9FFB34DE933E5AFD700EB0C8AF4F30FA2752F3BB9B4DA346A9BD46FCAFD55A07A9AF567F5FE2D…….
ike V=root:0:My-IPsec-VPN:286: sent IKE msg (SA_INIT_RESPONSE): 999.999.999.999:4500->192.168.1.100:59785, len=441, vrf=0, id=4e4531924d116d66/36cc22de3413cf57, oif=47
ike 0:My-IPsec-VPN:286: IKE SA 4e4531924d116d66/36cc22de3413cf57 SK_ei 16:687B168C0DB8F362141B198B41F88128
ike 0:My-IPsec-VPN:286: IKE SA 4e4531924d116d66/36cc22de3413cf57 SK_er 16:F629E19F00F928EC2B7973AE6DB01C42
ike 0:My-IPsec-VPN:286: IKE SA 4e4531924d116d66/36cc22de3413cf57 SK_ai 32:9E571000676274B06B6C379E9F0DA1DF26D250D395A6AC8115FBADDD107F7775
ike 0:My-IPsec-VPN:286: IKE SA 4e4531924d116d66/36cc22de3413cf57 SK_ar 32:53E8113A27AD1A2C0794B335518D1231C9E9DD961CEE7AC9BCD41554D8B092AA

<-- Machine Cert Connection attempt dies right here, and throws a "CertificateSignFailed" error in FortiClient.

If I use a User Cert instead the connection attempt is able to continue on from that point  with -->

ike V=root:0: comes 192.168.1.100:53295->999.999.999.999:4500,ifindex=47,vrf=0,len=2532....
ike V=root:0: IKEv2 exchange=AUTH id=1853c55dacb84fb9/50e180db3dc23c56:00000001 len=2528
ike 0: in 1853C55DACB84FB950E180DB3DC23C562E20230800000001000009E0230009C48705F9A97DED98540153D251971283E8BC137805CB626A96EF657878BBD3205555CE735777DAB207C98E416223F0B8E5B16E323A7C22C8B7641D276FA7CAE0C320FBEC5DB8E881F8….. 

 Then goes on to connect successfully from there.

[FortiNet_Newb]

Maybe it is too long?  I'll try to include shortened version of the IKE debug below:

ike 0:My-IPsec-VPN:286: FCT EAP 2FA extension vendor ID received
ike V=root:0:My-IPsec-VPN:286: responder preparing SA_INIT msg
ike V=root:0:My-IPsec-VPN:286: create NAT-D hash local 999.999.999.999/4500 remote 192.168.1.100/59785
ike V=root:0:My-IPsec-VPN:286: sending CERTREQ payload (len=21)
ike V=root:0:My-IPsec-VPN:286: certreq[0]: 'DE611F4514795A658F3A617E24A17292045C506A'
ike 0:My-IPsec-VPN:286: out 4E4531924D116D6636CC22DE3413CF572120222000000000000001B9220000300000002C010100040300000C0100000C800E00800300000802000005030000080300000C000000080400000E28000108000E000084E1D1ECDF56AF02AEA3C210056CB29FEDD9FFB34DE933E5AFD700EB0C8AF4F30FA2752F3BB9B4DA346A9BD46FCAFD55A07A9AF567F5FE2D…….
ike V=root:0:My-IPsec-VPN:286: sent IKE msg (SA_INIT_RESPONSE): 999.999.999.999:4500->192.168.1.100:59785, len=441, vrf=0, id=4e4531924d116d66/36cc22de3413cf57, oif=47
ike 0:My-IPsec-VPN:286: IKE SA 4e4531924d116d66/36cc22de3413cf57 SK_ei 16:687B168C0DB8F362141B198B41F88128
ike 0:My-IPsec-VPN:286: IKE SA 4e4531924d116d66/36cc22de3413cf57 SK_er 16:F629E19F00F928EC2B7973AE6DB01C42
ike 0:My-IPsec-VPN:286: IKE SA 4e4531924d116d66/36cc22de3413cf57 SK_ai 32:9E571000676274B06B6C379E9F0DA1DF26D250D395A6AC8115FBADDD107F7775
ike 0:My-IPsec-VPN:286: IKE SA 4e4531924d116d66/36cc22de3413cf57 SK_ar 32:53E8113A27AD1A2C0794B335518D1231C9E9DD961CEE7AC9BCD41554D8B092AA 

<-- Machine Cert Connection attempt dies right here, and throws a "CertificateSignFailed" error in FortiClient, no errors get shown in debug.

If I use a User Cert instead the connection attempt is able to continue on from that point  with -->

ike V=root:0: comes 192.168.1.100:53295->999.999.999.999:4500,ifindex=47,vrf=0,len=2532....
ike V=root:0: IKEv2 exchange=AUTH id=1853c55dacb84fb9/50e180db3dc23c56:00000001 len=2528
ike 0: in 1853C55DACB84FB950E180DB3DC23C562E20230800000001000009E0230009C48705F9A97DED98540153D251971283E8BC137805CB626A96EF657878BBD3205555CE735777DAB207C98E416223F0B8E5B16E323A7C22C8B7641D276FA7CAE0C320FBEC5DB8E881F8….. 

It then goes on to connect successfully from there. 

[funkylicious]

is the computer cert signed by the same CA you defined/installed on the FGT as remote CA?

does it appear as trusted on the installed pc and the chain of trusted ca/certs?

feel free to share a sanitized config for ipsec / peer .

[FortiNet_Newb]

Yes, all certs involved are signed by the same CA.  The machine cert shows as trusted and indicates it also has the private key.

MyFortiGate # sh user ldap
config user ldap
    edit "My LDAP Server"
        set server "mydc.mydomain.local"
        set secondary-server "mydc2.mydomain.local"
        set cnid "sAMAccountName"
        set dn "dc=mydomain,dc=local"
        set type regular
        set username "MyDomain\\LDAP-User"
        set password <>
        set secure ldaps
        set ca-cert "MyDomain-CA"
        set port 636
        set password-expiry-warning enable
        set password-renewal enable
    next
end

MyFortiGate # sh user peer
config user peer
    edit "peer_VPN-Users"
        set ca "MyDomain-CA"
        set mfa-mode subject-identity
        set mfa-server "My LDAP Server"
    next
end

MyFortiGate # sh user peergrp
config user peergrp
    edit "peerGrp_VPN-Users"
        set member "peer_VPN-Users"
    next
end

MyFortiGate # sh vpn ipsec phase1-int
config vpn ipsec phase1-interface
    edit "My-IPsec-VPN"
        set type dynamic
        set interface "wan1"
        set ike-version 2
        set authmethod signature
        set peertype peergrp
        set net-device disable
        set mode-cfg enable
        set proposal aes128-sha256 aes256-sha256
        set dpd on-idle
        set dhgrp 14
        set eap enable
        set eap-identity send-request
        set eap-cert-auth enable
        set certificate "My-IPsecVPN-Cert"
        set peergrp "peerGrp_VPN-Users"
        set assign-ip-from name
        set dns-mode auto
        set ipv4-split-include "Group - IPsec VPN Split Tunnel Destinations"
        set ipv4-name "My-IPsec-VPN_range"
        set dpd-retryinterval 60
    next
end

MyFortiGate # sh vpn ipsec phase2-int
config vpn ipsec phase2-interface
    edit "My-IPsec-VPN"
        set phase1name "My-IPsec-VPN"
        set proposal aes128-sha256 aes256-sha256
        set dhgrp 14
    next
end

[funkylicious]

for machine cert, try removing/unset the lines below and then test.

        set mfa-mode subject-identity
        set mfa-server "My LDAP Server"

i mentioned above that it will fail with them and later on tested with a dedicated cert that has a certain subject and didnt need these lines anymore.

they work just fine with user cert, but not with machine cert.

[FortiNet_Newb]

I tried removing those settings

config user peer
    edit "peer_VPN-Users"
        set ca "MyDomain-CA"
    next
end

With that configuration it still fails when using the machine cert, and it now also fails when using a cert (as expected).

[funkylicious]

that's strange.

for me with worked with both still, after i removed them, did test it.

L.E. i would suggest trying FCT 7.4.3, i see that 7.4.4 has quite a few issues with Remote Access.

L.E2 when starting a debug, besides diag debug app ike -1, also enable for fnbamd -1, when trying to connect.

[FortiNet_Newb]

If I enable debug for dnbamd it doesn't seem to make a difference when using the machine cert as no related fnbamd related lines show up in the output as it fails before any dnbamd related items are checked.