Authentication method

For site-to-site IPsec tunnels between two FortiGates or a FortiGate and another VPN gateway, authentication is typically done using pre-shared keys or certificates. For remote access dialup VPN, users can authenticate using pre-shared keys or certificates and through Extended Authentication (XAuth) in IKEv1 tunnels or EAP in IKEv2 tunnels. Authentication can be any of the following methods supported by the FortiGate:

Authentication Methods	IKE Version	Requirement
Pre-shared key PKI (Signature)	IKEv1 and IKEv2	Required to configure one of these authentication methods
LDAP	IKEv1 and IKEv2 (requires EAP-TTLS)	Optional user authentication methods. (IPsec IKEv1 uses XAUTH, and IPsec IKEv2 uses EAP for user authentication.)
Local RADIUS	IKEv1 and IKEv2
SAML	IKEv2
Two-factor authentication	IKEv1 and IKEv2	Optional

Pre-shared key and PKI authentication can be paired with any of the other user authentication methods. Two-factor authentication using FortiToken is also supported and can work in combination with Local, LDAP, RADIUS, or SAML authentication. Two-factor authentication with client certificate is also supported.

Pre-shared key

Using a pre-shared key is less secure than using certificates, especially if it is used alone, without requiring peer IDs or extended user authentication like XAuth or EAP. There also needs to be a secure way to distribute the pre-shared key to the peers.

If you use pre-shared key authentication alone, all remote peers and dialup clients must be configured with the same pre-shared key. Optionally, you can configure remote peers and dialup clients with unique pre-shared keys. On the FortiGate, these are configured in user accounts, not in the phase 1 settings.

The pre-shared key must contain at least six printable characters and should be known by network administrators. For optimum protection against currently known attacks, the key must consist of a minimum of 16 randomly chosen alphanumeric characters. The limit is 128 characters.

If you use a pre-shared key as the authentication method, you cannot also use client certificate as another authentication method.

To authenticate the FortiGate using a pre-shared key:

1. Go to VPN > VPN Tunnels and create a new tunnel, or edit an existing one.

2. Configure or edit the Network section as needed.

3. Configure or edit the Authentication settings as follows:

   Method	Pre-shared Key
   Pre-shared Key	<string>
   IKE	Version 1 or Version 2
   Mode	In IKEv1, select Aggressive or Main mode.
   Accepted Peer ID	Select an Accept Type and the corresponding peer. Options vary based on the Remote Gateway and Authentication Method settings in the Network section. Peer Options are only available in IKEv1 Aggressive mode. For IKEv2, use Network overlay.
   Network Overlay	In IKEv2, enable to require peers to configure a Network ID. When multiple tunnels are configured on the same interface, Network ID is used to match the tunnel.

4. For the Phase 1 Proposal section, keep the default settings unless changes are needed to meet your requirements.

5. Optionally, for authentication parameters for a dialup user group, define XAUTH parameters.

6. Click OK.

Digital certificates

To authenticate the FortiGate using digital certificates, you must have the required certificates installed on the remote peer and on the FortiGate. The signed server certificate on one peer is validated by the presence of the root certificate installed on the other peer. If you use certificates to authenticate the FortiGate, you can also require the remote peers or dialup clients to authenticate using certificates. See Basic site-to-site VPN with digital certificate for a detailed example.

To authenticate the FortiGate using a digital certificate:

1. Go to VPN > VPN Tunnels and create a new tunnel, or edit an existing one.

2. Configure or edit the Network section as needed.

3. Configure or edit the Authentication settings as follows:

   Method	Signature
   Certificate Name	Select the certificate used to identify this FortiGate. If there are no imported certificates, consider first to generate a certificate from a Certificate Authority and import it into the FortiGate. See Import a certificate. If that is not possible, consider using the Fortinet_Factory certificate.
   IKE	Version 1 or Version 2
   Mode	In IKEv1, Aggressive is recommended.
   Accepted Peer ID	For Accept Type, select Peer certificate and select the peer and the CA certificate used to authenticate the peer. You can define more granular parameters for the peer when you create or edit a PKI user. See Configuring a PKI user. If the other end is using the Fortinet_Factory certificate, then use the Fortinet_CA certificate here.

4. For the Phase 1 Proposal section, keep the default settings unless changes are needed to meet your requirements.

5. Optionally, for authentication parameters for a dialup user group, define XAUTH or EAP parameters.

6. Click OK.

When using signature as an authentication method in IKEv2, FortiClient supports submitting a certificate to FortiOS IKEv2 for validation, then continuing to the configured EAP method (EAP-MSCHAPv2 or EAP-TTLS) for authentication.

Certificate authentication as an additional step is enabled using the following configuration in FortiOS.

config vpn ipsec phase1-interface
    edit <tunnel>
        set authmethod signature
        set peertype peer
        set eap enable
        set eap-cert-auth {*disable | enable}
        set peer <user peer>
    next
end

For an example, see VPN 2FA with EAP and certificate authentication.