Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Peddy1976
New Contributor II

Setting UP IpSec vpn with Xauth and Radius

Hi all,

 

for a new customer where I have to connect a lot of branch offices I woul'like to test a solution on which the router at the Spoke will set up an IpSec Vpn With the Hub, using Xauth with a Radius server.

 

My central firewall is a Fortigate. Below what I configured:

 

config vpn ipsec phase1-interface edit "VPN Office" set type dynamic set interface "wan1" set mode aggressive set proposal aes128-sha256 set localid "2.2.2.2" set dpd on-idle set dhgrp 5 set xauthtype auto set authusrgrp "Group-Office" set nattraversal disable set psksecret xxxxx next end

 

config vpn ipsec phase2-interface edit "VPN Office" set phase1name "VPN Office" set proposal aes128-sha256 set dhgrp 5 set keylifeseconds 28800 next end

 

config user radius edit "Radius" set server "10.1.30.254" set secret xxxxxxxxxx next end

 

config user local edit "user1" set type radius set radius-server "Radius" next end

 

 

config user group edit "Group-Office" set member "Radius" "user1" config match edit 1 set server-name "Radius" set group-name "*"

config firewall policy edit 2 set name "VPN Officei" set srcintf "VPN Office" set dstintf "LAN" set srcaddr "all" set dstaddr "LAN_10.1.30.0/24" set action accept set schedule "always" set service "ALL" set logtraffic all set groups "Group-Office" next end

 

 

I don't know what is wrong in the configuration, but no request reach the radius server (freeradius) for authentication.  Below the error on the debug:

 

ike 0:VPN Officei_0:5: peer has not completed XAUTH exchange

 

Any suggestion?

 

Many thanks,

Maury

1 REPLY 1
Toshi_Esumi
SuperUser
SuperUser

First I wouldn't configure any local user at all. Then your RADIUS server might be looking for nas-ip (your FG).

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors