RADIUS proxy authentication for FortiGates?

MG4 · ‎12-01-2024

Hello everyone,

I recently discovered that the FortiAuthenticator supports a proxy authentication mode for remote RADIUS servers:
FortiAuthenticator Documentation

However, the FortiGate does not seem to offer a similar option:

FortiGate 7.4.5 Documentation (our current version)
FortiGate 7.6.1 Documentation (latest version)

If you want to set up remote Dial-Up IPsec VPN tunnels using EAP-TLS authentication via Microsoft NPS (RADIUS), it seems you would need to purchase a FortiAuthenticator solely to forward the requests to the remote RADIUS server.

Will FortiGate ever introduce a proxy mode for authentication via remote RADIUS servers?

pminarik · ‎12-03-2024

The FortiGate is simply instructed to:

use EAP ("set eap enable" in phase1 config)
instructed which EAP server to use (indirectly via group selection -> use that group's auth server)

EAP methods are not configured on the FortiGate, this is negotiated between the supplicant (endpoint) and the EAP server through the "EAP tunnel". The correct place to enforce acceptable EAP methods is thus on the EAP/RADIUS server.

Btw, AFAIK FortiClient does not support EAP-TLS. When configured to send a user certificate, cert-based auth is performed (non-EAP).

As for documentation, you can use this as a starting point:

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/726232/windows-ikev2-native-...

I haven't tested it personally, so I cannot vouch for it to be 100% correct, but it sufficiently demonstrates how the config should look. Notice how there's no step where you configure which EAP method is to be used in the FGT's config.

[ corrections always welcome ]

View solution in original post

MG4 · ‎12-04-2024

The main challenge right now is the FortiClient. It seems we’ll need to switch to a different VPN client, as the FortiClient isn’t fully optimized for VPN functionality.

RADIUS proxy authentication for FortiGates?

Nominate a Forum Post for Knowledge Article Creation