Using single or multiple user groups for user authentication

User groups enable remote users to authenticate themselves before establishing a connection to the IPsec VPN tunnel. One or more user groups for user authentication can be configured under a single IPsec VPN tunnel. For information about configuring user groups, see User groups.

When configuring dialup or remote access IPsec VPNs, user groups can be specified in either the phase 1 settings or the firewall policy associated with the tunnel (along with the source address objects or address groups). They must not be configured in both.

The workflow for configuring user groups varies depending on whether the IPsec tunnel is set up using the IPsec Wizard or a custom IPsec configuration.

IPsec Wizard tunnel configuration

When configuring the tunnel, you can specify one or more user groups in the User authentication method option.

• Single user group:

  By default, the wizard uses IKEv1 and allows only a single user group to be used for user authentication, configured in the User Group field.

• Multiple user groups:

  By default, the wizard uses IKEv1 and allows only a single user group to be used for user authentication, configured in the User Group field. To use multiple groups:

  1. Specify a placeholder group when completing the wizard.

  2. After finishing the wizard, edit the tunnel and click Convert to Custom Tunnel.

  3. For IKEv1, edit the XAUTH settings and set User Group to Inherit from policy, then specify the user groups in the firewall policy Source field.

     For IKEv2, enable EAP in the CLI, then specify the user groups in the firewall policy Source field.

     config vpn ipsec phase1-interface
         edit <tunnel-name>
             set eap enable
             set eap-identity send-request
         next
     end

Custom IPsec tunnel configuration

The custom IPsec tunnel configuration offers more granular settings to configure IPsec VPN. To configure a custom IPsec VPN tunnel, go to VPN > IPsec Tunnels, click Create New > IPsec Tunnel, and set the Template Type to Custom.

• Single user group:

  • GUI:

    In the VPN tunnel configuration, set IKE to version 1, enable XAUTH, and either:

    • Set User Group to Choose and select the required user group, or

    • Set User Group to Inherit from Policy and in the policy configuration, specify the user group in the Source field.

  • CLI:

    For IKEv1, enable XAUTH:

    config vpn ipsec phase1-interface
        edit <tunnel-name>
            set xauthtype {pap | chap | auto}
        next
    end
    

    For IKEv2, enable EAP:

    config vpn ipsec phase1-interface
        edit <tunnel-name>
            set eap enable
            set eap-identity send-request
        next
    end

    In the VPN tunnel configuration, either:

    • Set the user group (set authusrgrp <group-name>), or

    • Remove any configured user group (unset authusrgrp), then specify the user group in the firewall policy (set groups <group-name>).

• Multiple user groups:

  • GUI:

    In the VPN tunnel configuration, set IKE to version 1, enable XAUTH, and set User Group to Inherit from Policy. In the policy configuration, specify the user groups in the Source field.

  • CLI:

    For IKEv1, enable XAUTH:

    config vpn ipsec phase1-interface
        edit <tunnel-name>
            set xauthtype {pap | chap | auto}
        next
    end
    

    For IKEv2, enable EAP:

    config vpn ipsec phase1-interface
        edit <tunnel-name>
            set eap enable
            set eap-identity send-request
        next
    end

    In the VPN tunnel configuration, remove any configured user group (unset authusrgrp), then specify the user groups in the firewall policy (set groups <group-name> ... <group-name>).

Starting with FortiClient 7.4.4, IKEv1 is no longer supported on the client. Therefore, plan accordingly when choosing your IKE version. Use IKEv2 if you plan on deploying FortiClient 7.4.4 and later. Also, FortiClient 7.4.4 does not support IPv6.