ipsec with fortiauthenticator sms

[limbaev]

Hello is there a way to make this work, ipsec with fortiauthenticator User + sms?
only user working throw fortiauthenticator but sms no, in sslvpn all working good with sms.
Without fortitoken or cloud

[AEK]

Hi

What do you see in FAC auth logs?

Can you also try with mail OTP, just to see if it works.

On the other hand know that SMS token is not recommended anymore (for security).

[limbaev]

ID 2524767 | EAP Authentication Start — EAP session start from [MyIP]
ID 2524768 | Authentication Partially OK — “expecting SMS token”
ID 2524769 | 802.1x Authentication Failed
ID 2524770 | EAP-GTC login failed by [MyUsername] from [MyIP]

What this indicates:

• The user’s credentials (LDAP) are validated (“Partially OK”)

• FAC issues an SMS token challenge

• But the login ultimately fails (EAP-GTC failure) — meaning the client either did not respond or the response was rejected

In FortiGate debug (fnbamd / RADIUS flow):

• I see Sent radius req to server 'FSA': i.e. the Access-Request is being forwarded

• I see RADIUS resp code 11 (challenge) and later RADIUS resp code 3 (reject)

• FortiGate logs: EAP failed for user "Username"

So the flow is working to the point of challenge/response. The failure is in the response — the token response is not being accepted or returned.

What I’ve verified / tried:

• I enabled the setting in FAC to allow SMS fallback / challenge

• The user’s mobile number is set

• Without SMS (i.e. token disabled) the VPN connects fine

• But with SMS challenge, the login fails

[AEK]

As part of troubleshooting can you try mail OTP?

[limbaev]

Remote LDAP user authentication from [MYIP] (mschap) with email token failed: invalid password

and i didnt received any email just the test verify email, and the forticlient didnot request any 2fa only user and pass and then stuck and fail

[funkylicious]

well, the error is quite explicit. the password is not correct used by the user.

[limbaev]

User and pass sent ok and good. But email with otp not received and there is no way ro enter otp. And then jst getting failed

[funkylicious]

im not sure why you see 802.1x Authentication Failed, while you are doing IPsec/RADIUS auth .

or am i missing something and FGT doesnt have FortiAuth configured as a RADIUS server which proxies LDAP requests to AD ?

[AEK]

Hi Limbaev

Do you have multiple authentication servers configured on FGT? And is the user "MyUsername" defined on more than one authentication servers? In that case probably another authentication server has responded to the authentication request before the FAC's RADIUS server.

This is because FGT sends the auth request to all the configured auth servers and the first one who responds will be considered.