SSL-VPN authentication mechanism

[Zeihold_von_SSL]

Hello everybody, I have a question regarding ssl-vpn authentication. Today we use username/password for authenticating our ssl-vpn users. This is okay, but I want to add a little bit more security to it. About six months ago we implemented a root and a enterprise intermediate CA to our active directory so our clients already have client certificates enrolled. So I wanted to use that certificates to authenticate our users. The thing is, that I want to keep username/password authentication as a fallback mechanism (for example when a user is connecting from his private computer). I know that this is possible with our Cisco ASA, but is this also possible with a Fortigate?

[Anne]

Please check it with the TAC and update us as well. It will be good to have such a feature so that if the certificates expire, we are not panicking. Thanks Anne

[Zeihold_von_SSL]

Hi Anne, don' t get me wrong, but the last time I asked TAC for writing down a feature request (configure a custom NAS identifier (http://en.wikipedia.org/wiki/RADIUS -> attribute value pair 32) - support ticket 856701) they told me that I should contact sales (which was impossible due to a non functional email address). So I gave that to our partner (and I don' t know what happend then). So I don' t have much faith in TAC support any more (especially when it comes to feature requests). Kind Regards René