Two Factor Authentication with FortiClient via IPsec

[apex]

Hi All, I' m struggling with configuration of 2FA with forticlient over IPsec VPN. I have a FG100D running 5.0. My Fortitoken is installed my mobile. I configured SSL portal on the unit and can connect to it OK either via browser or FortiClient (5.0.2), then I authenticate successfully using my AD credentials (via LDAP) and then I' m being prompted for the token code - all works as expected However when I try connect with the FortiClient using IPSec VPN (forticlient 5.0.2 - interface mode with xauth, or forticlient 4.2.5 - tunnel mode with xauth) - I get the log on window, enter my credentials and I' m logged in... but... how do I use the token code here? I' m never get prompted for it? Has anyone configured 2FA with IPsec on FortiClient? I appreciate any suggestion and advice... Many thanks, A

[Chris_Lin_FTNT]

Hi, Can you show me your FortiGate firewall policy regarding the SSL portal, and how you create those users to use AD, and fortitoken?

[apex]

Hi Chris.Lin, thanks for msg, but the SSL works fine, it' s the IPsec that doesn' t prompt me for the token code..

[Chris_Lin_FTNT]

For FortiGate local user with FortiToken, I can get the token prompt for IPSec without problem. But I haven' t tried AD user + FortiToken and that' s why I am interested in how you configure that.

[L_FTNT]

However when I try connect with the FortiClient using IPSec VPN (forticlient 5.0.2 - interface mode with xauth, or forticlient 4.2.5 - tunnel mode with xauth) - I get the log on window, enter my credentials and I' m logged in... but... how do I use the token code here? I' m never get prompted for it?

Are you using the same user for both SSL VPN and IPSec VPN? If so, that would be very odd that it works for SSL but not for IPSec.

Has anyone configured 2FA with IPsec on FortiClient?

Yes, it worked like a charm for us :) To be accurate, you don' t need to do any special configuration on the FortiClient - all setup is on FGT - the user you use for xAuth should have 2-FA enabled. LC

[apex]

All sorted! I had an LDAP group set under xauth rather than a local one. Assigned membership of the AD users to local group and set this under phase1. All is working as expected Thanks guys! A