dial up tunnel 2FA for linux clients

[iamirreza13]

i'm trying to migrate from SSL vpn to IPsec remote access tunnel. Im using IKEv1 but the linux forticlient doesn't support IPsec. so I tried alternatives like Strongswan and Libreswan and i was able to connect to the tunnel. the users should have two step verification (i'm using email code) on but the problem is when the two step verification gets on i'm not able to connect to the tunnel anymore and it won't prompt for code. Is there anything i can do or any alternatives i could use to be able to connect when 2FA is on.

[funkylicious]

hi,

try appending the token inside the xauth password configuration, like : passwordTOKEN 

https://unix.stackexchange.com/questions/678751/ipsec-psk-vpn-with-strongswan-to-fortigate-with-one-...

L.E. I just saw that your token code is via email ... which means that you don't know/have it before connecting so this might not work in your case.

[iamirreza13]

hi,

thanks for your reply. yes i'm getting the token code via email and this won't help since the code will be send to email after the tunnel goes up. is there any other possible solution that can help me?

[AEK]

I don't know if strongSwan supports 2 step authentication or challenge-response (password then TOKEN), but I think funkylicious suggestion is correct if you have FortiAuthenticator or RADIUS authentication. In that case RADIUS server usually accepts concatenated 2FA auth ("passwordTOKEN")

However if the users is stored on FGT then I don't think there is a possibility of one step "passwordTOKEN".

Your solution is probably to use a RADIUS server or FAC.

[iamirreza13]

hi,

thank you very much for the insight. im using LDAP for users authentication and the code gets send after i enter the password and if the password is right. after that strongswan or any alternative that I've tested doesn't have an option to prompt for the code. if I use RADIUS does it make a difference? and I don't have access to fortitokens that's why i use the email token as 2fa

[AEK]

Hi

Are you using FreeIPA as LDAP? In that case you may not need to switch to RADIUS.

In FreeIPA you can assign an OTP Token to a user, in that case the token can be FortiToken, MS Authenticator, Google Authenticator, Red Hat's FreeOTP. I tested all of them with FreeIPA and all worked fine. I also guess any other should work.

For my test I configured my FortiGate to authenticate from the IP server and in that case the passwordTOKEN concatenation worked just fine.

[iamirreza13]

I'm using Open LDAP and seems like there's no option to assign an OTP Token to the users. Are you possibly aware of any alternatives to strongswan, libreswan, etc  that can handle this, or if forticlient is gonna support IPsec anytime soon?

[AEK]

I don't know other alternative to strongSwan but I don't think the issue is in strongSwan.

I think your solution is to keep strongSwan and once again use a RADIUS server (connected to your LDAP) for 2FA with OTP token with one step authentication.

[timesprayerme]

Use FortiClient with SSL-VPN Instead on Linux

The official FortiClient for Linux doesn't support IPsec, only SSL-VPN.

If you must use Fortinet’s own 2FA mechanism (e.g., email  codes), SSL-VPN is your best bet, as it supports the 2FA prompt natively.

[iamirreza13]

Hi
thanks for the reply. I'm migrating from SSL-VPN to IPSec since SSL-VPN has vulnerability and also fortigate has removed it in last update.