Setting UP IpSec vpn with Xauth and Radius

[Peddy1976]

Hi all,

for a new customer where I have to connect a lot of branch offices I woul'like to test a solution on which the router at the Spoke will set up an IpSec Vpn With the Hub, using Xauth with a Radius server.

My central firewall is a Fortigate. Below what I configured:

config vpn ipsec phase1-interface edit "VPN Office" set type dynamic set interface "wan1" set mode aggressive set proposal aes128-sha256 set localid "2.2.2.2" set dpd on-idle set dhgrp 5 set xauthtype auto set authusrgrp "Group-Office" set nattraversal disable set psksecret xxxxx next end

config vpn ipsec phase2-interface edit "VPN Office" set phase1name "VPN Office" set proposal aes128-sha256 set dhgrp 5 set keylifeseconds 28800 next end

config user radius edit "Radius" set server "10.1.30.254" set secret xxxxxxxxxx next end

config user local edit "user1" set type radius set radius-server "Radius" next end

config user group edit "Group-Office" set member "Radius" "user1" config match edit 1 set server-name "Radius" set group-name "*"

config firewall policy edit 2 set name "VPN Officei" set srcintf "VPN Office" set dstintf "LAN" set srcaddr "all" set dstaddr "LAN_10.1.30.0/24" set action accept set schedule "always" set service "ALL" set logtraffic all set groups "Group-Office" next end

I don't know what is wrong in the configuration, but no request reach the radius server (freeradius) for authentication.  Below the error on the debug:

ike 0:VPN Officei_0:5: peer has not completed XAUTH exchange

Any suggestion?

Many thanks,

Maury

[Toshi_Esumi]

First I wouldn't configure any local user at all. Then your RADIUS server might be looking for nas-ip (your FG).