VPN IPSEC Dialup Connection IKE v2

[Albimatta]

Hello Guys,

I have two questions about the Ike V2 IPSEC DIalup Connection.

I want to configure in my enviroment (two fortigate 100F HA) like 150 dialup external connection. I have setup an IPSEC Tunnel (IkeV2) and set policy correctly.

I created the users locally (without any Proxy or RADIUS) and inserted in a group.

The VPN works fine but i have two questions:

- Is binding set in the IPSEC configuration the authusrgrp? because i haven't set and i won't set because if i set, every time thast the people connect appear when the people search a local ip for example, the Fortigate Auth page, and for us isn't necessary. So if i unset that is an error?

-  Ikev2 works fine with the local user (i enabled the EAP)? because i haven't any other type of authentication

Thank you so much

[Yurisk]

Hi, a bit hard to understand the questions, but anyway:

- EAP is authentication, once you enable it, how further you authenticate users is up to you and security demands - if you set local user group, it will work, if you set RADIUS group - this will work too. Generally, local users with local authentication is deemed NOT best practice nowadays. What do you mean by "not setting authusrgrp" ? How does then local user authentication works? Did you set user group in rules instead?

- If you disable EAP (disabled by default), then users will only need Pre-Shared Key to connect, no user/pass will pop up, which is again - today deemed not best practice at all. 

Here is an example of working IKEv2 Dial up with local users/passwords:

config user group
    edit "yurisk1grp"
        set member "yurisk1"
    next
end

config vpn ipsec phase1-interface
    edit IKEv2
        set int port1
        set type dynamic
        set ike-version 2
        set peertype any
        set mode-cfg enable
        set ipv4-start 192.168.103.0
        set ipv4-end   192.168.103.10
        set dns-mode auto
        set eap enable
        set eap-identity send-request
        set authusrgrp yurisk1grp
        set psk LSkJDFHKJfh==
    end


config vpn ipsec phase2-interface
    edit "IKEv2P2"
        set phase1name "IKEv2"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256
    next
end


And rule allowing access to LAN for ANY service (not recommended):

config firewall policy
    edit 0
        set srcint IKEv2
        set dstint port1
        set srcaddr all
        set dstaddr all
        set service ALL
        set schedule always
        set action accept
        set nat enable
        set logtraffic all
    end

[Albimatta]

Hi Yuri thanks for your indications, and sorry for bad explanation of questions!

So my problem is, if i set this:

set authusrgrp yurisk1grp

Everytime that the people try to reach some internal ip (like a NAS or other) appear a fgtauth webpage (although there is a group policy with the users in the group, the address range, ecc..

)

The people pass the authentication through the FortiCLient but after, if they navigate to local ip, appears the Fortigate Authentication page

So i don't wanna that this page appear everytime and if i remove this:

set authusrgrp yurisk1grp

the fgtauth page doesn't appear anymore...