Migration from SSL VPN with RADIUS (FreeRADIUS + privacyIDEA) to IPsec VPN

[jbfreire]

Hello everyone,

I currently have an SSL VPN tunnel where authentication is performed via RADIUS using FreeRADIUS and privacyIDEA with 2FA. This setup works perfectly. It is deployed on a FortiGate 100F running FortiOS 7.6.2. I cannot upgrade to newer versions because SSL VPN support would be removed. Clients connect using the FortiClient VPN-only client.

I am trying to migrate to an IPsec VPN with a similar configuration. However, despite extensive research, I have not found a reasonable way to replicate the SSL VPN setup with IPsec.

According to the documentation, in order for IKEv2 to work with a RADIUS server such as FreeRADIUS, the EAP method on the FortiClient must be configured as EAP-TTLS/PAP instead of the default EAP-MSCHAPv2.

The problem is that configuring this in the FortiClient VPN-only requires editing the XML configuration file. This is a very advanced configuration step that I can perform myself, but I cannot reasonably require my end users to do so. Even with this workaround, true two-factor authentication would still not work properly, unless the password and token are concatenated, which is not ideal.

I have seen that this scenario can be handled using FortiClient ZTNA, but this solution is well beyond our budget.

Does anyone know of a way to configure an IPsec VPN with RADIUS-based two-factor authentication without requiring manual editing of the FortiClient XML configuration file?

It seems odd to me that the FortiGate requires us to move away from SSL VPN, yet does not provide equivalent authentication options for IPsec VPN.

Thank you in advance for any guidance or suggestions.

[funkylicious]

i would rather use IKEv1 instead of IKEv2, as long as you dont use FortiClient 7.4.4 which doesnt support IKEv1 and requires a EMS license.

[jbfreire]

Yes, I have considered that option as well. However, IKEv1 was deprecated in 2023, and it is likely that Fortinet will discontinue support for it in the near future. I am therefore looking for a solution that is more stable and sustainable over time.

One possible approach would be to continue using SSL VPN tunnels on FortiOS 7.4.x and wait for the newer IPsec features to mature further.

[piri]

I've had to go down this road to due IkeV1 deprecation and having to maintain FortiToken MFA, etc. etc.  It is definitely a real pain.  Key configuration elements on the firewall that only exist in CLI must be set and then the XML file for "VPN Only" clients must be edited without any real beneficial documentation or assistance from Fortinet.  It took me months to get the configuration right and even now lots of VPN disconnects whereas SSL VPN always just worked.