SSL VPN - Duo Authentication

[DaveG-PW]

Hey,

Looking incorporate are existing Duo 2FA setup into our FortiGate VPN, I've followed through the guide but falling at the last hurdle.

I've gotten as far as adding the Duo Proxy host as a radius server in Forti and if I do "Test Credentials" here it all works as expected, I get a prompt on my phone and a success message when I accept it.

I've then tried to apply this to the VPN by creating a new user group linked to the radius server and changing the group in the SSL VPN Settings > Authentication / Portal Mapping section to be the new group.

Unfortunately when I then try to connect to the VPN it never prompts for verification, just fails to authenticate.

I have also ran the following at the CLI to increase the timeout but it didn't help.

config system global
set remoteauthtimeout 60
end

I'm sure I've missed something super simple, but can't see what at the moment.

[Debbie_FTNT]

PS: if it DOES work: SSLVPN realms make FortiGate pre-select the matching group (and thus server) from SSLVPN group/portal mappings, instead of trying any possible based on SSLVPN policies.
Using realms, you can be sure that FortiGate checks only against groups that are linked to the specific realm.

[DaveG-PW]

And I think we have a winner.

So the problem was both the original user group "VPN Users" and the new one "VPN Users Duo" where using the same active directory security group for their member list.

I've just created a new AD group, which I've told the Duo Proxy to use,  added myself to that and took myself out of the AD group associated with "VPN Users" and it looks to be working.

Need to do a bit more testing but it looks like we are good, thanks everyone for the input.