VPN IPSEC IKEv2 RADIUS AD Multiple groups and multiple tunneling

[Pauta]

Hello everyone,
I’m new to this community and to Fortinet products in general. I’ve been working for years with a Cisco ASA Firepower 5506-X, and I’m now migrating the entire setup to a FortiGate 100F running firmware 7.6.4.

Overall, the FortiGate configuration process has been quite straightforward — except for the VPN part, which has caused me quite a few headaches. I’d like to share what I had configured on the ASA and what I’m trying to replicate on the FortiGate (note: I don’t have an EMS license).

On the ASA, I had two WAN interfaces (primary and backup), each with its own self-signed certificate issued by an internal Active Directory CA (Windows Server 2022).
Within the ASA, I had four VPN profiles:
• VPN Normal
• VPN IT
• VPN Advanced
• VPN External

Each profile had its own split tunneling configuration, allowing users to see only the networks relevant to their access level.

Each profile also had a dedicated IP pool and DNS settings (internal AD DNS for corporate users and public DNS for external users).

Each VPN profile was linked to an AD group through LDAP authentication.

The authentication worked in two ways:
1. Users selected the Enterprise group and entered their username and password.
2. Users selected the Certificates group, and the connection was automatically established using their self-signed certificate installed on their corporate computers.

By default, AnyConnect validated the certificate and connected automatically.

On the FortiGate (7.6.4), this setup became more complex since it uses IPsec VPN with IKEv2.
I’ve successfully configured the VPN using the RADIUS server from AD, and authentication works correctly. The RADIUS response includes the user’s group, which I’m mapping on the FortiGate — that part is already working fine.

However, my challenge now is how to handle multiple user groups (from AD) so that each group:
• has its own split-tunneling routes,
• receives its corresponding IP pool,
• and gets the correct DNS servers.

I’ve tried creating multiple VPN configurations sharing the same IKEv2 pre-shared key, assigning routes, IP pools, and DNS settings per group. Unfortunately, it only applies to the first profile, and the subsequent ones are ignored.

What would be the recommended way to implement this on FortiGate?

Ideally, I’d like to replicate the ASA structure without relying on EMS.

Additional context:

The routing to internal VLANs is handled by a Cisco router. The FortiGate only connects to a VLAN that routes to that Cisco device.

Any insights or guidance would be greatly appreciated!
Thanks in advance for your help.

[funkylicious]

hi,

one quick way to achieve this is with IKEv1 and xauth/peer id and create multiple tunnels for each group/peer id ( to differentiate the ipsec tunnels )

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-Peer-IDs-to-select-an-IPsec-dia... 

L.E. for IKEv2 to achieve something similar you would need EMS to configure network-id on FortiClient side

[Pauta]

Thank you very much for your comment. Unfortunately, from what I've read, IKEV1 is no longer supported since version 7.4.4, so I have to use IKEV2 (https://docs.fortinet.com/document/fortigate/7.6.0/ssl-vpn-to-ipsec-vpn-migration/883534/ikev1-or-ik...). Unfortunately, I don't have the budget (nor do I need it) to implement an EMS.

Does anyone know a way to implement it without requiring an EMS license?

[funkylicious]

FortiClient 7.4.4 is available only with the paid version, meaning you would need EMS therefore while using a free version ( < 7.4.4 ) you would be fine.