IPsec IKEv2 VPN with LDAP username/password, computer certificate, and MFA

[FortiNet_Newb]

We currently have a dial-up SSL VPN configuration that requires a user to connect using both their Windows AD (LDAP) credentials AND a local computer certificate issued from our internal Windows CA.  On top of that, we use FortiToken with push notifications for MFA on the LDAP user accounts.

With the recent push to migrate away from SSL VPN and switch over to using IPsec IKEv2 VPNs instead, I have not been able get the same requirements to work via IPsec.

Our setup includes:

FortiOS – 7.4.8

FortiEMS – 7.4.3

FortiClient – 7.4.3

FortiToken  Subscription (not cloud)

Windows NPS for RADIUS (not FAC)

Is this even possible with the above?  Seems like it is supported, but I can not get it to work with NPS.

According to the article below, I should be able to get FortiToken MFA push notifications working using local RADIUS user accounts:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IKEv2-Dialup-IPsec-tunnel-with-RADIUS-and/... 

…but as soon as I enable FortiToken on a RADIUS user account, NPS fails authentication (error code 16).  If I don't enable FortiToken, simple RADIUS user authentication works fine.

If I try to leave out the MFA requirement, I can’t seem to get the right combination of settings on the IPsec Tunnel and in FortiClient (using EMS) to require both a username/password AND a local computer certificate to authenticate successfully using NPS.  I can get one or the other working.

Any guidance would be appreciated.

Thanks!

[Matt_B]

Thank you, this appears to match known issue 1205084 . It's scheduled for fix in FCT v7.4.5. https://docs.fortinet.com/document/forticlient/7.4.4/windows-release-notes/573433/new-known-issues.

"Re-importing the certificate" is the listed workaround for v7.4.4, but in your case I think that would mean provisioning each certificate again since each device is enrolling with the Private CA, which I agree is a significant change.

In the thread you linked I saw you were targeting v7.4.4 to allow FortiToken MFA to work with LDAP users and EAP-TTLS. You may already be aware, but in FCT v7.4.3 Active Directory users can authenticate to IKEv2 IPsec VPN using EAP-MSCHAPv2, with FortiToken MFA supported:

>NPS: Technical Tip: IKEv2 Dialup IPsec tunnel with RADIUS and FortiToken MFA

>FortiAuthenticator joined to AD domain: with Active Directory authentication enabled: Technical Tip: Authenticating users using MSCHAP2 PEAP

If using EAP-MSCHAPv2, note that FortiToken MFA for IKEv2 tunnels does change significantly between firmware versions: Technical Tip: Required firmware/software versions for using FortiToken Mobile or OTP MFA with Forti...