ipsec RA vpn with certificate authentication

[sajith]

Could any one guide me to configure the certificate based RA VPN configuration. We have 20 clients which need to authenticate by using certificate. i am confused with which certicate need  to be installed on the  fortigate and forticlient and how to install it.

[Rewanta_FTNT]

Hi,

You need certificates on FGT as well as on client. 

1. on fgt you can generate a CSR and obtain a signed cert from trusted CA. Details are on the below guide-

http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FortiGatev30FromT...

2. on forticlient if you are using 5 version, you need to use the VPN editor (only available on licensed FC ) to generate a CSR and submit the CSR to trusted CA and import the signed certificate to FC. 

3. You need to import the ca root certs to FGT and FC for the signature verification. 

4. On FGT phase1 settings.

Authentication Method - Signature

Certificate - select the signed certificate as per step-1. 

4. On FC, Under Certificate Management, import the signed certificate then select it. 

You may follow the ipsec guide from 

docs.fortinet.com

Thanks,

Rewanta