Technical Tip: Restricting VPN access with two-factor and LDAP authentication

[mforbes]

Description

This article describes how to restrict VPN access with two-factor and LDAP authentication.

Scope

FortiGate.

Solution

1. Configure FortiGate to LDAP link.

For more details on How to configure FortiGate to use an LDAP server do not forget to validate the connection status successfully with the green checkmark.

2. Import user from LDAP as 'local' user.
   User and authentication -> User Definition -> Create New.
   
   
   
   
3. Assign a FortiToken to the imported LDAP user, an activation code will be sent to the email address. 
   

     

4. Create a Local User Group.
   •  Add LDAP users that have FortiTokens assigned.
   •  The 'Remote Group' option is not needed.
   
5. Add the 'Remote Access' group to the SSL VPN setting Authentication Portal Mapping as required.
   

    

6. Configure Firewall Policy for SSL VPN users.