Part 1: Identifying user authentication methods

In Part 1, we identify the user authentication methods currently used in your SSL VPN configuration. For each method, we outline any restrictions and limitations related to using those methods for IPsec.

User authentication methods on FortiGate require configuration of either users or user groups. These user groups make use of different authentication servers, such as RADIUS, LDAP, and SAML inside their configuration. These preconfigured objects can generally be used in the IPsec VPN configurations without further modifications.

Follow these steps to identify the user authentication method currently used in your SSL VPN configuration. If you already know the authentication method, you can skip these steps and go to Next steps after identifying the authentication method.

To identify the user authentication method currently used in SSL VPN configurations:

1. Locate the user group(s) used in SSL VPN firewall policies:

   1. Go to Policy & Object > Firewall Policy.

   2. Edit the firewall policy that has SSL-VPN tunnel interface (ssl.root) in the Incoming interface field.

   3. Note the user groups used in the Source field inside the firewall policy.

   4. Perform the same step for all SSL VPN firewall policies to get a list of user groups used for SSL VPN user authentication.

2. Identify the configured authentication method for SSL VPN:

   1. Go to User & Authentication > User Groups, and edit the group(s).

   2. Use the following statements to help you identify the configured authentication method:

      If the configuration shows	Your authentication method is
      Local users configured under Member with no configuration under Remote Groups > Remote Server	Local user authentication
      Remote Groups > Remote Server, uses LDAP Server	LDAP-based user authentication
      Remote Groups > Remote Server, uses RADIUS Server	RADIUS-based user authentication
      Remote Groups > Remote Server, uses SAML SSO Server	SAML-based user authentication
      PKI users are configured under Member, and if Remote Groups > Remote Server uses LDAP Server If Remote Group > Remote Server uses LDAP Server, then you are using Certificate-based user authentication with LDAP as two-factor authentication. If Remote Group > Remote Server uses RADIUS Server, then you are using Certificate-based user authentication with RADIUS as two-factor authentication.	Certificate-based user authentication Note: This guide does not demonstrate how to migrate certificate-based user authentication.

Next steps after identifying the authentication method

Based on the identified authentication method, go to the following topics to find more information about migrating the authentication method to IPsec VPN as well as specific IPsec IKE version support requirements, if any:

• Local user authentication

• LDAP-based user authentication

• RADIUS-based user authentication

• SAML-based user authentication

After reviewing the authentication method, move to Part 2, which outlines configuring IPsec tunnel using IPsec wizard and makes use of user groups discussed in Part 1.