Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
apex
New Contributor

Two Factor Authentication with FortiClient via IPsec

Hi All, I' m struggling with configuration of 2FA with forticlient over IPsec VPN. I have a FG100D running 5.0. My Fortitoken is installed my mobile. I configured SSL portal on the unit and can connect to it OK either via browser or FortiClient (5.0.2), then I authenticate successfully using my AD credentials (via LDAP) and then I' m being prompted for the token code - all works as expected However when I try connect with the FortiClient using IPSec VPN (forticlient 5.0.2 - interface mode with xauth, or forticlient 4.2.5 - tunnel mode with xauth) - I get the log on window, enter my credentials and I' m logged in... but... how do I use the token code here? I' m never get prompted for it? Has anyone configured 2FA with IPsec on FortiClient? I appreciate any suggestion and advice... Many thanks, A
5 REPLIES 5
Chris_Lin_FTNT

Hi, Can you show me your FortiGate firewall policy regarding the SSL portal, and how you create those users to use AD, and fortitoken?
apex
New Contributor

Hi Chris.Lin, thanks for msg, but the SSL works fine, it' s the IPsec that doesn' t prompt me for the token code..
Chris_Lin_FTNT

For FortiGate local user with FortiToken, I can get the token prompt for IPSec without problem. But I haven' t tried AD user + FortiToken and that' s why I am interested in how you configure that.
L_FTNT
Staff
Staff

However when I try connect with the FortiClient using IPSec VPN (forticlient 5.0.2 - interface mode with xauth, or forticlient 4.2.5 - tunnel mode with xauth) - I get the log on window, enter my credentials and I' m logged in... but... how do I use the token code here? I' m never get prompted for it?
Are you using the same user for both SSL VPN and IPSec VPN? If so, that would be very odd that it works for SSL but not for IPSec.
Has anyone configured 2FA with IPsec on FortiClient?
Yes, it worked like a charm for us :) To be accurate, you don' t need to do any special configuration on the FortiClient - all setup is on FGT - the user you use for xAuth should have 2-FA enabled. LC
Ling Lu
apex
New Contributor

All sorted! I had an LDAP group set under xauth rather than a local one. Assigned membership of the AD users to local group and set this under phase1. All is working as expected Thanks guys! A
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors