IPsec VPN with IKEv2 and LDAP authentication error

[damianhlozano]

Hello team!!!

We have a Fortigate 100F with many IPsec VPNs for FortiClient

I configured all IPsec VPNs with IKE v1 and allways used an AD group synchronized in the Fortigate for user authentication

Also, I use the peer ID field to select an specific VPN

All these VPNs are working

Now I created an IPsec VPN with IKE v2, but when I try to connect, I get an error:

In FortiClient: Wrong Credentials EAP failed connecting to VPNname

In Fortigate: date=2025-07-23 time=16:06:15 eventtime=1753297576267021760 tz="-0300" logid="0101037121" type="event" subtype="vpn" level="error" vd="root" logdesc="Negotiate IPsec phase 1" msg="negotiate IPsec phase 1" action="negotiate" remip=1.3.5.7 locip=1.2.3.4 remport=4500 locport=4500 outintf="port9" srccountry="Argentina" cookies="b51c1f1809859ab8/7f365d0b1f864add" user="1000" group="N/A" useralt="N/A" eapuser="testdomain" eapauthgroup="N/A" assignip=N/A vpntunnel="IPsec-dom-W3" status="failure" result="N/A" peer_notif="NOT-APPLICABLE" fctuid="E2D4BA7AF7DD4761B682A1A835348004" advpnsc=0

This is the VPN config:

config vpn ipsec phase1-interface
   edit "IPsec-dom-W3"
      set type dynamic
      set interface "port9"
      set ike-version 2
      set peertype one
      set net-device disable
      set mode-cfg enable
      set ipv4-dns-server1 150.0.0.14
      set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256
      set comments "VPN: IPsec-dom-W3 -- Created by VPN wizard"
      set dhgrp 20
      set eap enable
      set eap-identity send-request
      set wizard-type dialup-forticlient
      set authusrgrp "VPN-domain_Users"
      set transport udp
      set peerid "1000"
      set ipv4-start-ip 10.0.210.151
      set ipv4-end-ip 10.0.210.250
      set ipv4-netmask 255.255.255.0
      set ipv4-split-include "IPsec-DialUp-domain-rutas"
      set save-password enable
      set psksecret ENC xxx
   next
end

config vpn ipsec phase2-interface
   edit "IPsec-dom-W3"
      set phase1name "IPsec-dom-W3"
      set proposal aes128-sha1 aes256-sha256
      set dhgrp 20
      set comments "VPN: IPsec-dom-W3 -- Created by VPN wizard"
   next
end

config system interface
   edit "IPsec-dom-W3"
      set vdom "root"
      set type tunnel
      set snmp-index 62
      set interface "port9"
   next
end

config user group
   edit "VPN-domain_Users"
      set member "srvxdctemp"
      config match
      edit 1
         set server-name "srvxdctemp"
         set group-name "CN=GRP-Acceso-VPN-domain,OU=Grupos de    Navegacion,OU=domain,DC=domain,DC=com,DC=ar"
         next
      end
   next
end

I tried adding a local user to the VPN Group and I could connect using the local user, I cannot connect using AD user wich is in this group.

When I change from IKE v2 to IKE v1, the VPN works.

Any Idea?

Thanks in advance.

Regards,

Damián

[sferoz]

Kindly do the following for the fix:
Migrate to use RADIUS-based user authentication with EAP;
Use EAP-TTLS to support LDAP user authentication.
For an explanation of EAP-TTLS, see EAP-TTLS support for IPsec VPN - FortiClient 7.4.0 new features.
To implement EAP-TTLS, there are some requirements.
FortiClient version 7.4.3 and later;
FortiClient EMS 7.4;
IKEv2 tunnel (works with IKEv2 over UDP or TCP).

Kindly refer to the below for more info :
https://community.fortinet.com/t5/FortiGate/Technical-Tip-IKEv2-tunnel-fails-when-LDAP-based-usergro...

https://docs.fortinet.com/document/fortigate/latest/administration-guide/442351/ldap-authentication-...
https://docs.fortinet.com/document/forticlient/7.4.0/new-features/907253/eap-ttls-support-for-ipsec-...

[damianhlozano]

Thanks for your answer sferoz!!!

IKEv1 is obsolete

The second article that you shared, says that I must use EAP-TTLS, which supports LDAP.

What is the standard in Fortigate tor Active Directory authentication for VPNs?

Thanks in advance.

Regards,

Damián

[FortiDor · Accepted solution]

Hello @damianhlozano 

For your information you can keep the LDAP connection between your FGT and your AD. 

You need to follow this KB to solve your issue :

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IKEv2-tunnel-fails-when-LDAP-based-usergro...

and add the <eap_method>2</eap_method> line in your FCT XML file for your VPN connection 

[damianhlozano]

Thanks a lot!

This worked for me

[Maerre]

I've almost the same issue, but i'm using radius instead of ldap, and no EMS.

i'm using 2 dial up vpn, one with Cisco Duo as Mfa and radius and the other one with another radius and no mfa. 
the first once is ok, but the second one fails every time with "wrong eap credential", it's making me crazy and can't open a case because using the free version 7.4.3 of forticlient.

do you have any tip?