Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
altanet
New Contributor

Trying to use LDAP for user authentication of FortiClient IPsec VPN

I have tried everything I can think of. Cannot seem to get AD/LDAP credentials to process from FortiClient IPsec VPN client. Locally-stored user works fine to establish tunnel, but not LDAP. Running on FG200B-4.0MR3(Build441) I' ve got multiple LDAP servers defined and can expand the tree with no problem using ' Regular' binding. F/W rule is set for Policy-based IPsec tunnel, which points to User Group, containing three variants of the same of LDAP-defined user (straight username, domainname\username, and username@our.domain.name.com). I' ve added the multi-group option to the user config definition for this VDOM. At this point, I don' t care if a user is a member of a particular group or not, I just want to authenticate the user. Since the user has to be a firewall-defined user anyway, AD group control seems redundant. I see on the forum folks say it works like a charm and others say it' s like pulling teeth. I' ve seen this post (http://support.fortinet.com/forum/tm.asp?m=69588) and it comes close, but not enough detail to seal the deal. Many thanks in advance for any configuration or diagnostic suggestions.
10 REPLIES 10
altanet
New Contributor

To amend to the description: I see in a packet trace (while attempting FortiClient VPN authentication) between the FortiGate and the chosen AD/LDAP server, I see the searchRequest for the entire distinguished name and common name being the AD VPN group that contains my userid. The ' assertionvalue' is xxx_VPN_Users=myuserid. The next packet is the LDAP reply of searchResDone with a resultCode of success (0). This looks like the call is being made to AD and the reply is one of success. The big question for me: does that merely confirm the existance of my userid in that group and where does the userid/password validation happen? At the FortiClient, it' s three prompts for userid/password and it' s over. Thanks
Matthijs
New Contributor II

Try this on the commandline:
 diag debug enable
 
 diag debug appl authd -1
 
see what happens when you try to login. To reset debug:
 diag debug disable
 diag debug reset
 
If you can' t seem to find the problem try posting the output of:
 show user ldap
 
 show user group
 
altanet
New Contributor

Hello Matthijs, Thank you for your suggestions. Sorry to be so delayed with a response. So many fires and only one extinguisher. I get no output from the debug/authd environment. Just this message about every 10 seconds: ' message_loop: checking timeouts' while debug is active. I' ve duplicated this VPN config on a different FG200B cluster that is running v4.0,build0291,100824 (MR2 Patch 2); so I' m thinking that I' ve got something wrong with my config; just can' t seem to find it. I' ve tried both route-based and policy-based f/w policy methods. Just to emphasize: the FG is supposed to be able to lateral the FortiClient user' s userid/password to LDAP (AD) for validation? Here is the output from the show commands: FG200B-1 (RA-VPN) # show user ldap config user ldap edit " LDAPSvr1" set server " xxx.xxx.xx.x" set cnid ' ' set dn " OU=grp,DC=xx,DC=xx,DC=xxxxx,DC=com" set type regular set username " domain\\userid" set password ENC encrypted password for above user set filter ' ' next end FG200B-1 (RA-VPN) # show user group config user group edit " FSAE_Guest_Users" set group-type directory-service next edit " CRL500 via LDAP Config" set member " CRL500" " gbolger" next end Thanks again for your thoughts
rwpatterson
Valued Contributor III

Try adding the below:
ORIGINAL: altanet config user ldap edit " LDAPSvr1" set server " xxx.xxx.xx.x" set cnid " samaccountname" set dn " DC=xx,DC=xx,DC=xxxxx,DC=com" set type regular set username " cn=userid,cn=users,DC=xx,DC=xx,DC=xxxxx,DC=com" set password ENC encrypted password for above user set filter ' ' <- ( not needed ) next end
For v4 MR3, the group is set in a different location. I' m not sure where since I' m not up there yet. Search the forums.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
altanet
New Contributor

Thanks for input. What does " samaccountname" refer to? I have seen the CNID/CN field described to be used for the user/security group where your VPN users are located, to leave blank, as well as just the literal value ' cn' . I currently have the username configured in the form of cn=userid,cn=users,DC=xx.... I just got feedback from FN TAC to issue the ' diag test auth ldap <server_name> <username> <password>. Do you happen to know the recommended form for the username? I have tried straight username, domain\username, and username@my.domain.name.com. No matter what format I use the command returns ' authenticate <username> against <server name> failed!' Thanks
rwpatterson
Valued Contributor III

User name (in the login window) is the user name without the domain. " samaccountname" is a windows security setting. Does your IAS server allow the FGT to poll it? You have to allow it from AD and set the shared secret there as well.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
nthrzerp
New Contributor

Greetings. Not sure if this is exactly relevant, but.... This help page indicates that " Note: A user group cannot be a dialup group if any member is authenticated using a RADIUS or LDAP server." My ldap authentication works just fine with PPTP (Bob' s post herein about LDAP is spot on), but it would not work with a dialup IpSec definition in my Fortigate 60b running,as you are, under the latest MR3. http://help.fortinet.com/fos40hlp/43/wwhelp/wwhimpl/js/html/wwhelp.htm?context=fgt&topic=usergrp&single=true
altanet
New Contributor

Thanks to all who contributed. I' ' ll post more details later, but after an hour-long Web-Ex session with FN TAC, it' s working now. Summary: 1) used ' sAMAccountName' in User/Remote/LDAP CN Identifier field. 2) DN field was coded to the root of our AD domain-this was not clear to me earlier (starting at the top), User/User Group entry using three (remote server) DCs configured with the specific AD group where our VPN users must exist to use the IPsec VPN from the FortiGate.
newuser74

Hello,

 

I'm running into the same issue on a Fotinet 110C.  Was wondering if you could post the solution.

 

Thank you,

Al

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors