VPN IPSEC Dialup Connection IKE v2

[Albimatta]

Hello Guys,

I have two questions about the Ike V2 IPSEC DIalup Connection.

I want to configure in my enviroment (two fortigate 100F HA) like 150 dialup external connection. I have setup an IPSEC Tunnel (IkeV2) and set policy correctly.

I created the users locally (without any Proxy or RADIUS) and inserted in a group.

The VPN works fine but i have two questions:

- Is binding set in the IPSEC configuration the authusrgrp? because i haven't set and i won't set because if i set, every time thast the people connect appear when the people search a local ip for example, the Fortigate Auth page, and for us isn't necessary. So if i unset that is an error?

-  Ikev2 works fine with the local user (i enabled the EAP)? because i haven't any other type of authentication

Thank you so much

[Albimatta]

I appreciate it if someone can explain this.

I don't understand why, if i put this:

config vpn ipsec phase1-interface
edit "IPSEC_NOVA"
set type dynamic
set interface "wan1"
set ike-version 2
set peertype any
set net-device disable
set mode-cfg enable
set proposal aes128-sha256 aes256-sha256
set localid "*****"
set comments "******"
set dhgrp 5
set eap enable
set eap-identity send-request
set authusrgrp "Mygroup"
set ipv4-start-ip 192.168.55.1
set ipv4-end-ip 192.168.55.5
set dns-mode auto
set ipv4-split-include "192.168.0.0/16"
set client-keep-alive enable

and i have set a firewall policy correctly with the groups for IPSEC and the correctly range ip address, everytime appear the fgtauth (i think Captive Portal) and for remove this i must remove this string:

set authusrgrp "Mygroup"

For not showing the captive portal...

Also,in the Interface settings, the IPSEC setting have the Network - Security mode disabled...

[Yurisk]

Is this a case, by any chance, of remote users being already authenticated and connected with Forticlient, still getting the authentication pop up? Like this:

Because I've heard of such cases with 200E/400E after recent firmware upgrades, while haven't seen myself.  Also no Captivate portal is enabled or used in FOrtigate. 

[Albimatta]

Hi Yuri, is correctly. The users can authenticate with the FortiClient, and when search a internal LAN IP (like a NAS) appears the redirect fgt auth portal. But in all the settings (Interface, Users, ecc...) the captive portal is set to off.

[Yurisk]

Well, in that case I would classify it as a bug and if you have Support active for this Fortigate, you could open a ticket with Fortinet TAC. As per configuration it should not be happening (provided you don't use User Groups in rules as well).