RADIUS proxy authentication for FortiGates?

[MG4]

Hello everyone,

I recently discovered that the FortiAuthenticator supports a proxy authentication mode for remote RADIUS servers:
FortiAuthenticator Documentation

However, the FortiGate does not seem to offer a similar option:

• FortiGate 7.4.5 Documentation (our current version)
• FortiGate 7.6.1 Documentation (latest version)

If you want to set up remote Dial-Up IPsec VPN tunnels using EAP-TLS authentication via Microsoft NPS (RADIUS), it seems you would need to purchase a FortiAuthenticator solely to forward the requests to the remote RADIUS server.

Will FortiGate ever introduce a proxy mode for authentication via remote RADIUS servers?

[sjoshi]

can you check if this helps you out:-

https://community.fortinet.com/t5/FortiNAC/Technical-Tip-RADIUS-Proxy-with-FortiGate-and-FortiAuthen...

[MG4]

The question was whether the FortiGate will ever get the proxy mode or if it will remain a feature exclusive to the FortiAuthenticator. Because buying a FortiAuthenticator solely to forward the requests to the remote RADIUS server would be ridiculous.

[adambomb1219]

Why do you want to do this?  Why not use SAML?  Why not just forward those RADIUS requests directly to another RADIUS server?

[MG4]

The FortiGate currently supports forwarding only MS-CHAPv2, MS-CHAP, CHAP, or PAP requests—not EAP-TLS. Unlike the FortiAuthenticator with proxy mode, the FortiGate cannot directly forward authentication requests to a remote RADIUS server, only the supported authentication protocols. Currently, I only want to set up EAP-TLS authentication for remote dial-up VPN clients, not many (at most 10).

[adambomb1219]

Can EAP-TLS be terminated directly on the firewall though?  Is there a need for RADIUS here at all?  Can you just authenticate based on TLS trust alone?  Sorry I'm not too familiar with the setup for dial-up VPN.  Are you talking for FortiClient remote users or firewall to firewall VPN?

[MG4]

Let me clarify the problem:

1. The user selects their smartcard with a user certificate for authentication.
2. They initiate the IKEv2 VPN tunnel.
3. The FortiGate receives the IKEv2 VPN initiation and attempts to authenticate the user.

The issue occurs at this step: the FortiGate fails because it only supports MS-CHAPv2, MS-CHAP, CHAP, or PAP—not EAP-TLS.

This is specifically an IKEv2 IPsec VPN, not an SSL VPN. Simplified, the authentication happens in Phase 1, a tunnel is established, and sessions are created in Phase 2. Various authentication protocols can be used in this process, but the FortiGate doesn’t support EAP-TLS for remote RADIUS server users.

If the FortiGate had a proxy mode like the FortiAuthenticator, it could handle EAP-TLS requests.

[pminarik]

FortiGate has no limitation as to which RADIUS server can be used to process EAP authentication for it.

Direct integration with NPS works just fine. FortiAuthenticator is not required for this.

What you see in the RADIUS server settings (auto|PAP|CHAP|MS-CHAP|MS-CHAPv2) is configuration relevant purely for non-EAP authentication.

EAP authentication is used automatically in a feature if that feature supports it and is configured to use it. (802.1x switch auth, WPA-Enterprise on Wifi, EAP auth for IKEv2 IPsec)

But be aware that if you want to do 2FA (username + password + OTP) over EAP, you will likely have issues with third-party servers. There's no established standard for it, so it's bit of a wild west. (FCT+FGT+FAC do it in a custom fashion over modified EAP-MS-CHAPv2, if that interests you).

[MG4]

Is there a knowledgebase article about this scenario? Because I don't see how you could configure such a IPsec Tunnel on the FortiGate. Because the only way would be with signatures. Having to build 10 different tunnels for each user and his certificate.

Scenario:
FortiClient <VPN with EAP-TLS Authentication> FortiGate <User Authentication> Remote-RADIUS-Server

1. The VPN client uses a user certificate for authentication.
2. The FortiGate forwards the authentication request to the remote RADIUS server.
3. The RADIUS server validates the user certificate.
4. IKEv2 Phase 1 is completed
5. ...

[pminarik · Accepted solution]

The FortiGate is simply instructed to:

• use EAP ("set eap enable" in phase1 config)
• instructed which EAP server to use (indirectly via group selection -> use that group's auth server)

EAP methods are not configured on the FortiGate, this is negotiated between the supplicant (endpoint) and the EAP server through the "EAP tunnel". The correct place to enforce acceptable EAP methods is thus on the EAP/RADIUS server.

Btw, AFAIK FortiClient does not support EAP-TLS. When configured to send a user certificate, cert-based auth is performed (non-EAP).

As for documentation, you can use this as a starting point:

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/726232/windows-ikev2-native-...

I haven't tested it personally, so I cannot vouch for it to be 100% correct, but it sufficiently demonstrates how the config should look. Notice how there's no step where you configure which EAP method is to be used in the FGT's config.