SSL VPN - Duo Authentication

[DaveG-PW]

Hey,

Looking incorporate are existing Duo 2FA setup into our FortiGate VPN, I've followed through the guide but falling at the last hurdle.

I've gotten as far as adding the Duo Proxy host as a radius server in Forti and if I do "Test Credentials" here it all works as expected, I get a prompt on my phone and a success message when I accept it.

I've then tried to apply this to the VPN by creating a new user group linked to the radius server and changing the group in the SSL VPN Settings > Authentication / Portal Mapping section to be the new group.

Unfortunately when I then try to connect to the VPN it never prompts for verification, just fails to authenticate.

I have also ran the following at the CLI to increase the timeout but it didn't help.

config system global
set remoteauthtimeout 60
end

I'm sure I've missed something super simple, but can't see what at the moment.

[Zekeout]

Might be worth checking out the following KB from Duo, i know we ran into similar issues after updating FortiOS but i don't recall exactly where the connection was failing for us.

https://help.duo.com/s/article/9012?language=en_US

Side note, we previously used Duo for Radius auth to our sslvpn and switched over to Duo SSO for the vpn as it provides a much better user experience IMO - just food for thought 

[funkylicious]

what FortiOS are you running on the FGT ?

also, did you ran any kind of debug for radius to see where the issue might be ?

[DaveG-PW]

Hi,

Currently running v7.2.10 build1706.

Yes have done some diagnostics, just to confirm when using the diagnostics command or using the "Test Credentials" button on the RADIUS server configuration screen, it all works find, the prompt is sent to my phone and it's approved.

It just doesn't work when trying to use in against the VPN logon.

[funkylicious]

https://www.reddit.com/r/fortinet/comments/1foj7e4/7210_breaks_duo_radius_proxy/ 

[Debbie_FTNT]

Hey Dave,

a few things you could check:

- FortiGate may require the Message-Authenticator attribute from your Duo RADIUS server (the GUI test can be unreliable in verifying the connection).

- you can disable the Message-Authenticator requirement via CLI:
config user radius

edit <>

set require-message-authenticator disable

end

- if you work with user groups, ensure that Duo RADIUS sends the correct RADIUS attributes so FortiGate can match the expected user groups: Technical Tip: How FortiGate determines group memberships from RADIUS responses 

Hope this helps!

Cheers,

Debbie

[DaveG-PW]

So I've made some progress on this.

I've added the new users group to all the firewall rules surrounding the VPN and now I do get the prompt on my phone.

However, I get this prompt whether I have the group in the SSL-VPN setting page set to the old none RADIUS group or the new RADIUS enabled user group, for the former the VPN connects regardless of what I do with the prompt (Approve / Deny or Ignore) and for the latter it still fails to authenticate.

"Sorry, could not start connection "myvpn".
Error: Revoked by Android: REBOOT!"

Similarly on Windows, I get the prompt on my phone but the client immediately shows that the connection went down again.

[krahemat_FTNT]

Have a look at this document as it may help you find the authentication issue:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-Troubleshooting/ta-p/189542 

The FNBAMD should tell you where you are failing in the debug.

Hope this helps.

[DaveG-PW]

Thanks, I've turned that on and it does provide some interesting although confusing information, it's hard to tell where one "request" ends and another begins but the main thing that jumps out at me is these lines:

deconstruct_session_id:492 decode session id ok, user=[MY_USER_NAME], group=[VPN Users],authserver=[WINDOWS_DC_HOST],portal=[web-access],host[1MY_LAN_IP]

It still seems to be submitting the request via the old (Non Duo) user group, the new group and the one I had set in the SSL-VPN Settings > Authentication Mapping section is "VPN Users Duo" , that group also uses different RADIUS server, not WINDOWS_DC_HOST.

Am I just being really stupid and I've missed some where that I need to change the user group that is being used for authentication?

[Debbie_FTNT]

Hey Dave,

one thing to be aware of:

-> FortiGate only relies on the SSLVPN group settings to select the appropriate portal, nothing else (unless you configure sslvpn realms)

-> It relies solely on the groups set in policies to determine what groups to check the user against

-> in that case, first server to respond with successful auth wins, and that's the server (and group) FortiGate goes with

-> it will apply the default VPN portal ('all other users/groups') if there is no defined portal mapping for the specific server/group

--> that may be why it says 'web_access': 

deconstruct_session_id:492 decode session id ok, user=[MY_USER_NAME], [...],portal=[web-access],[...]

-> if you're trying to connect from a FortiClient, it may fail here because FortiGate offers web_mode instead of tunnel_mode.

Perhaps give SSLVPN realms a try:
- enable them under System > Feature Select

- configure a realm with a simple string like 'duo' as name

- in the SSLVPN group/portal mapping, edit the mapping for your desired group, and add the realm 'duo'

- in your FortiClient (or browser), access: https://<vpn-ip/FQDN>:<port>/duo   
-> see if that works

Cheers,

Debbie