VPN IPSEC Dialup Connection IKE v2

[Albimatta]

Hello Guys,

I have two questions about the Ike V2 IPSEC DIalup Connection.

I want to configure in my enviroment (two fortigate 100F HA) like 150 dialup external connection. I have setup an IPSEC Tunnel (IkeV2) and set policy correctly.

I created the users locally (without any Proxy or RADIUS) and inserted in a group.

The VPN works fine but i have two questions:

- Is binding set in the IPSEC configuration the authusrgrp? because i haven't set and i won't set because if i set, every time thast the people connect appear when the people search a local ip for example, the Fortigate Auth page, and for us isn't necessary. So if i unset that is an error?

-  Ikev2 works fine with the local user (i enabled the EAP)? because i haven't any other type of authentication

Thank you so much

[Yurisk]

Hi, a bit hard to understand the questions, but anyway:

- EAP is authentication, once you enable it, how further you authenticate users is up to you and security demands - if you set local user group, it will work, if you set RADIUS group - this will work too. Generally, local users with local authentication is deemed NOT best practice nowadays. What do you mean by "not setting authusrgrp" ? How does then local user authentication works? Did you set user group in rules instead?

- If you disable EAP (disabled by default), then users will only need Pre-Shared Key to connect, no user/pass will pop up, which is again - today deemed not best practice at all. 

Here is an example of working IKEv2 Dial up with local users/passwords:

config user group
    edit "yurisk1grp"
        set member "yurisk1"
    next
end

config vpn ipsec phase1-interface
    edit IKEv2
        set int port1
        set type dynamic
        set ike-version 2
        set peertype any
        set mode-cfg enable
        set ipv4-start 192.168.103.0
        set ipv4-end   192.168.103.10
        set dns-mode auto
        set eap enable
        set eap-identity send-request
        set authusrgrp yurisk1grp
        set psk LSkJDFHKJfh==
    end


config vpn ipsec phase2-interface
    edit "IKEv2P2"
        set phase1name "IKEv2"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256
    next
end


And rule allowing access to LAN for ANY service (not recommended):

config firewall policy
    edit 0
        set srcint IKEv2
        set dstint port1
        set srcaddr all
        set dstaddr all
        set service ALL
        set schedule always
        set action accept
        set nat enable
        set logtraffic all
    end

[Albimatta]

Hi Yuri thanks for your indications, and sorry for bad explanation of questions!

So my problem is, if i set this:

set authusrgrp yurisk1grp

Everytime that the people try to reach some internal ip (like a NAS or other) appear a fgtauth webpage (although there is a group policy with the users in the group, the address range, ecc..

)

The people pass the authentication through the FortiCLient but after, if they navigate to local ip, appears the Fortigate Authentication page

So i don't wanna that this page appear everytime and if i remove this:

set authusrgrp yurisk1grp

the fgtauth page doesn't appear anymore...

[hbac]

Hi @Albimatta,

Do you have group specified as source in the firewall policy?  

Regards, 

[Albimatta]

Yes i specified a group and a range IP Address in a firewall Policy from Tunnel IPSEC to Internal LAN

[hbac · Accepted solution]

Hi @Albimatta,

Group should not be specified in the firewall policy. You can specify it under IPsec phase1-interface. 

Regards, 

[Albimatta]

After i seen this post, i remove the group from FIrewall Policy and keep only the group in phase1 and the fgtauth page disappear....thank you so much again to all!

[iamirreza13]

HI @hbac @Albimatta 
I can't find groups to specify them under IPsec phase1-interface. Can you guide me where exactly can i find this setting?

grazie

[Yurisk]

Hi @iamirreza13 , It is possible Group Setting is visible on CLI only, once you are in the GUI editing Phase1 interface - to the right you will see button "Edit in CLI", click on it, it will open the Phase1-interface in config mode, just enter the command: 

set authusrgrp yurisk1grp

where instead of yurisk1grp you put your group of users you created previously.

[iamirreza13]

HI @Yurisk thanks for the insight
yes seems like i can only config it with CLI and it did work for local users i had on fortigate and from what i read seems like it works with RADIUS too but i authenticate users with LDAP and when i try a user from LDAP it can't connect to the tunnel. what's your suggestion in this case.

also i have some other question can you please answer them:
1- on android forticlient i didn't see any option for user and pass but when it's only pre shared key it works. when i turn the EAP on it doesn't ask for pass and can't connect. what can i do?

2- i've used this config:

          set eap enable

                set eap-identity [use-id-payload|send-request]

                set acct-verify [enable|disable]

                set authusrgrp "ExampleGroup"

i can only connect when identity is on send request. when i try "use-id-payload" i get time out. whats the difference between these two?

grazie mille.