Adding FIC MFA to remote access IPsec VPN

This use case shows how to add FIC multi-factor authentication (MFA) to a FortiClient dialup VPN configuration (see FortiClient as dialup client).

Creating users

To create users from the GUI:

1. Select User & Device > User Definition.
2. Select Create New.
3. Select Local User, and click Next.
4. Name the user "test-ipsec".
5. Enable the User Account Status.
6. Enter a unique password for the user.
7. Enter the user's email address.
8. Enable two-factor Authentication, and set the Authentication Type to FortiIdentity Cloud.
9. Click OK.
10. Repeat Steps 1 through 9 to create another user named "testipsec2".

To create users from the Console:

config user local
    edit "test-ipsec"
        set type password
        set passwd <user-password>
        set two-factor fortitoken-cloud
        set email-to <user@abc.com>
    next
end
 
 
config user local
    edit "testipsec2"
        set type password
        set passwd <user-password>
        set two-factor fortitoken-cloud
        set email-to <user@abc.com>
    next
end

Creating a user group

To create a user group from the GUI:

1. Select User & Device > User Groups.
2. Click Create New.
3. Name the user group "ipsecgrp".
4. Set User Group Type to Firewall .
5. Click the + sign (Add) in the Member box to add users "test-ipsec" and "testipsec2" to the user group.
6. Click OK.

To create a user group from the Console:

config user group
    edit "ipsecgrp"
        set member "test-ipsec" "testipsec2"
    next
end