Agentless VPN with multiple RADIUS servers

When configuring two or more RADIUS servers, you can configure a Primary and Secondary server within the same RADIUS server configurations for backup purposes. You can also configure multiple RADIUS servers within the same User Group to service the access request at the same time.

A tertiary server can be configured in the CLI.

Sample topology

Sample configurations

• Configure a Primary and Secondary server for backup

• Authenticating to two RADIUS servers concurrently

Configure a Primary and Secondary server for backup

When you define a Primary and Secondary RADIUS server, the access request will always be sent to the Primary server first. If the request is denied with an Access-Reject, then the user authentication fails. However, if there is no response from the Primary server after another attempt, the access request will be sent to the Secondary server.

In this example, you will use a Windows NPS server as the Primary server and a FortiAuthenticator as the Secondary server. It is assumed that users are synchronized between the two servers.

To configure the internal and external interfaces:

1. Go to Network > Interfaces.

2. Edit the port1 interface and set IP/Network Mask to 192.168.2.5/24.

3. Edit the port2 interface and set IP/Network Mask to 192.168.20.5/24.

4. Click OK.

To create a firewall address:

1. Go to Policy & Objects > Addresses and select Address.

2. Click Create new.

3. Set Name to 192.168.20.0.

4. Leave Type as Subnet

5. Set IP/Netmask to 192.168.20.0/24.

6. Click OK.

To add the RADIUS servers:

1. Go to User & Authentication > RADIUS Servers and click Create New.

2. Set Name to PrimarySecondary.

3. Leave Authentication method set to Default. The PAP, MS-CHAPv2, and CHAP methods will be tried in order.

4. Under Primary Server, set IP/Name to 192.168.20.6 and Secret to the shared secret configured on the RADIUS server.

5. Click Test Connectivity to test the connection to the server, and ensure that Connection status is Successful.

6. Under Secondary Server, set IP/Name to 192.168.2.71 and Secret to the shared secret configured on the RADIUS server.

7. Click Test Connectivity to test the connection to the server, and ensure that Connection status is Successful.

8. Click OK.

To configure the user group:

1. Go to User & Authentication > User Groups and click Create New.

2. In the Name field, enter PrimarySecondaryGroup.

3. In the Remote Groups area, click Add, and from the Remote Server dropdown, select PrimarySecondary.

4. Click OK, and then click OK again.

To configure Agentless VPN portal:

1. Go to VPN > Agentless VPN Portals, and click Create New.

2. Enter a Name, such as agentless-portal.

3. Under Predefined Bookmarks, click Create New, and enter following details:

   Field	Value
   Name	Windows Server
   Type	RDP
   Host	192.168.1.114
   Port	3389
   Single Sign-On	Disable
   Username	Set the username to login to Windows Server
   Password	Set the password to login to Windows Server
   Port	3389
   Single Sign-On	Disable

4. Click OK to save the predefined bookmark.

5. Click OK to save the portal settings.

6. Create another Agentless VPN Portal and name it as portal-access-disabled.

7. Click OK.

8. Disable Agentless VPN for the newly created portal (that is, portal-access-disabled) using CLI:

   config vpn ssl web portal
       edit "portal-access-disabled"
           set web-mode disable
       next
   end

To configure the Agentless VPN settings:

1. Go to VPN > Agentless VPN Settings.

2. Set Agentless VPN to Enable.

3. Set the Listen on Interface(s) to wan1.

4. Set Listen on Port to 10443.

5. Set Server Certificate to the authentication certificate.

6. In Authentication/Portal Mapping, select All Other Users/Groups, and click Edit.

7. Use Portal dropdown to select portal-access-disabled.

8. In Authentication/Portal Mapping, click Create New.

   1. Set Users/Groups to PrimarySecondaryGroup.

   2. Set Portal to agentless-portal.

   3. Click OK.

9. Click Apply to save the Agentless VPN settings.

To configure Agentless VPN firewall policy:

1. Go to Policy & Objects > Firewall Policy and click Create New.

2. Set Name as Agentless VPN firewall policy.

3. Set Schedule to always and Action to Accept.

4. Set Incoming interface to Agentless VPN interface (ssl.root).

5. Choose an Outgoing Interface. This example uses port1.

6. Set the Source to all and User/group to PrimarySecondaryGroup.

7. In this example, the Destination is the internal, protected subnet 192.168.1.0.

8. Set Service to ALL.

9. Click OK.

To configure Agentless VPN using the CLI:

1. Configure the internal interface and firewall address:

   config system interface

   edit "port3"

   set vdom "root"

   set ip 192.168.20.5 255.255.255.0

   set alias "internal"

   next

   end

   config firewall address

   edit "192.168.20.0"

   set uuid cc41eec2-9645-51ea-d481-5c5317f865d0

   set subnet 192.168.20.0 255.255.255.0

   next

   end

2. Configure the RADIUS server:

   config user radius

   edit "PrimarySecondary"

   set server "192.168.20.6"

   set secret <secret>

   set secondary-server "192.168.2.71"

   set secondary-secret <secret>

   next

   end

3. Add the RADIUS user to the user group:

   config user group

   edit "PrimarySecondaryGroup"

   set member "PrimarySecondary "

   next

   end

4. Configure Agentless VPN portal and predefine RDP bookmark for windows server.

   config vpn ssl web portal
       edit "agentless-portal"
           set web-mode enable
           config bookmark-group
               edit "gui-bookmarks"
                   config bookmarks
                       edit "Windows Server"
                           set apptype rdp
                           set host "192.168.1.114"
                           set port 3389
                           set logon-user "your-windows-server-user-name"
                           set logon-password your-windows-server-password
                       next
                   end
               next
           end
       next
   end

5. Configure another Agentless VPN portal and disable Agentless VPN on it.

   config vpn ssl web portal
       edit "portal-access-disabled"
           set web-mode disable
       next
   end

6. Configure Agentless VPN settings:

   config vpn ssl settings
       set servercert "server_certificate"
       set source-interface "wan1"
       set source-address "all"
       set default-portal "portal-access-disabled"
       config authentication-rule
           edit 1
               set groups "PrimarySecondaryGroup"
               set portal "agentless-portal"
           next        
       end
   end

7. Configure one Agentless VPN firewall policy to allow remote users to access the internal network. This policy does not allow traffic initiated from internal network to remote client.

   config firewall policy 
       edit 1
           set name "Agentless VPN firewall policy"
           set srcintf "ssl.root"
           set dstintf "port1"
           set srcaddr "all"
           set dstaddr "192.168.1.0"
           set action accept
           set schedule "always"
           set service "ALL"
           set nat enable
           set groups “PrimarySecondaryGroup”
       next
   end

To verify the connection:

User radkeith is a member of both the NPS server and the FAC server.

When the Primary server is up, the user successfully connects to Agentless VPN.

# diagnose sniffer packet any 'port 1812' 4 0 l

interfaces=[any]

filters=[port 1812]

2020-05-15 16:26:50.838453 port3 out 192.168.20.5.2374 -> 192.168.20.6.1812: udp 118

2020-05-15 16:26:50.883166 port3 in 192.168.20.6.1812 -> 192.168.20.5.2374: udp 20

2020-05-15 16:26:50.883374 port3 out 192.168.20.5.2374 -> 192.168.20.6.1812: udp 182

2020-05-15 16:26:50.884683 port3 in 192.168.20.6.1812 -> 192.168.20.5.2374: udp 228

The access request is sent to the Primary NPS server 192.168.20.6, and the connection is successful.

# get vpn ssl monitor

Agentless VPN Login Users:

Index   User            Group                   Auth Type      Timeout         From     HTTP in/out    HTTPS in/out

0       radkeith       PrimarySecondaryGroup   2(1)            285     192.168.2.202          0/0     0/0

Agentless VPN sessions:

Index   User       Group                   Source IP      Duration        I/O Bytes       Tunnel/Dest IP

When the Primary server is down, and the Secondary server is up, the user successfully connects to Agentless VPN again:

# diagnose sniffer packet any 'port 1812' 4 0 l

interfaces=[any]

filters=[port 1812]

2020-05-15 16:31:23.016875 port3 out 192.168.20.5.7989 -> 192.168.20.6.1812: udp 118

2020-05-15 16:31:28.019470 port3 out 192.168.20.5.7989 -> 192.168.20.6.1812: udp 118

2020-05-15 16:31:30.011874 port1 out 192.168.2.5.23848 -> 192.168.2.71.1812: udp 118

2020-05-15 16:31:30.087564 port1 in 192.168.2.71.1812 -> 192.168.2.5.23848: udp 20

Access request is sent to the Primary NPS server 192.168.20.6, but there was no response. RADIUS authentication falls through to the Secondary FortiAuthenticator 192.168.2.71, and the authentication was accepted. The Agentless VPN connection is established.

# get vpn ssl monitor

Agentless VPN Login Users:

Index   User            Group                  Auth Type      Timeout         From     HTTP in/out    HTTPS in/out

0       radkeith        PrimarySecondaryGroup   2(1)            287     192.168.2.202        0/0        0/0

Agentless VPN sessions:

Index   User            Group                    Source IP      Duration        I/O Bytes       Tunnel/Dest IP

Authenticating to two RADIUS servers concurrently

There are times where users are located on separate RADIUS servers. This may be the case when migrating from an old server to a new one for example. In this scenario, a Windows NPS server and a FortiAuthenticator are configured in the same User Group. The access-request is sent to both servers concurrently. If FortiGate receives an access-accept from either server, authentication is successful.

To configure the internal and external interfaces:

1. Go to Network > Interfaces.

2. Edit the port1 interface and set IP/Network Mask to 192.168.2.5/24.

3. Edit the port2 interface and set IP/Network Mask to 192.168.20.5/24.

4. Click OK.

To create a firewall address:

1. Go to Policy & Objects > Addresses and select Address.

2. Click Create new.

3. Set Name to 192.168.20.0.

4. Leave Type as Subnet

5. Set IP/Netmask to 192.168.20.0/24.

6. Click OK.

To configure the first RADIUS server:

1. Go to User & Authentication > RADIUS Servers and click Create New.

2. Set Name to win2k16.

3. Leave Authentication method set to Default. The PAP, MS-CHAPv2, and CHAP methods will be tried in order.

4. Under Primary Server, set IP/Name to 192.168.20.6 and Secret to the shared secret configured on the RADIUS server.

5. Click Test Connectivity to test the connection to the server, and ensure that Connection status is Successful.

6. Click OK.

To configure the second RADIUS server:

1. Go to User & Authentication > RADIUS Servers and click Create New.

2. Set Name to fac.

3. Leave Authentication method set to Default. The PAP, MS-CHAPv2, and CHAP methods will be tried in order.

4. Under Primary Server, set IP/Name to 192.168.2.71 and Secret to the shared secret configured on the RADIUS server.

5. Click Test Connectivity to test the connection to the server, and ensure that Connection status is Successful.

6. Click OK.

To configure the user group:

1. Go to User & Authentication > User Groups and click Create New.

2. In the Name field, enter dualPrimaryGroup..

3. In the Remote Groups area, click Add, and from the Remote Server dropdown, select fac.

4. Click Add again. From the Remote Server dropdown select win2k16 and click OK.

5. Click OK, and then click OK again.

To configure Agentless VPN portals:

1. Go to VPN > Agentless VPN Portals, and click Create New.

2. Enter a Name, such as agentless-portal.

3. Under Predefined Bookmarks, click Create New, and enter following details:

   Field	Value
   Name	Windows Server
   Type	RDP
   Host	192.168.1.114
   Port	3389
   Single Sign-On	Disable
   Username	Set the username to login to Windows Server
   Password	Set the password to login to Windows Server
   Port	3389
   Single Sign-On	Disable

4. Click OK to save the predefined bookmark.

5. Click OK to save the portal settings.

6. Create another Agentless VPN Portal and name it as portal-access-disabled.

7. Click OK.

8. Disable Agentless VPN for the newly created portal (that is, portal-access-disabled) using CLI:

   config vpn ssl web portal
       edit "portal-access-disabled"
           set web-mode disable
       next
   end

To configure the Agentless VPN settings:

1. Go to VPN > Agentless VPN Settings.

2. Set Agentless VPN to Enable.

3. Set the Listen on Interface(s) to wan1.

4. Set Listen on Port to 10443.

5. Set Server Certificate to the authentication certificate.

6. In Authentication/Portal Mapping, select All Other Users/Groups, and click Edit.

7. Use Portal dropdown to select portal-access-disabled.

8. In Authentication/Portal Mapping, click Create New.

   1. Set Users/Groups to dualPrimaryGroup.

   2. Set Portal to agentless-portal.

   3. Click OK.

9. Click Apply to save the Agentless VPN settings.

To configure Agentless VPN firewall policy:

1. Go to Policy & Objects > Firewall Policy and click Create New.

2. Set Name as Agentless VPN firewall policy.

3. Set Schedule to always and Action to Accept.

4. Set Incoming Interface to Agentless VPN tunnel interface(ssl.root).

5. Choose an Outgoing Interface. This example uses port1.

6. Set Source to all and User/group to dualPrimaryGroup.

7. In this example, the Destination is the internal, protected subnet 192.168.10.0.

8. Set Service to ALL.

9. Click OK.

To configure Agentless VPN using the CLI:

1. Configure the internal interface and firewall address:

   config system interface

   edit "port2"

   set vdom "root"

   set ip 192.168.20.5 255.255.255.0

   set alias "internal"

   next

   end

   config firewall address

   edit "192.168.20.0"

   set uuid cc41eec2-9645-51ea-d481-5c5317f865d0

   set subnet 192.168.20.0 255.255.255.0

   next

   end

2. Configure the RADIUS server:

   config user radius

   edit "win2k16"

   set server "192.168.20.6"

   set secret <secret>

   next

   edit "fac"

   set server "192.168.2.71"

   set secret <secret>

   next

   end

3. Add the RADIUS user to the user group:

   config user group

   edit "dualPrimaryGroup"

   set member "win2k16" “fac”

   next

   end

4. Configure Agentless VPN portal and predefine RDP bookmark for windows server.

   config vpn ssl web portal
       edit "agentless-portal"
           set web-mode enable
           config bookmark-group
               edit "gui-bookmarks"
                   config bookmarks
                       edit "Windows Server"
                           set apptype rdp
                           set host "192.168.1.114"
                           set port 3389
                           set logon-user "your-windows-server-user-name"
                           set logon-password your-windows-server-password
                       next
                   end
               next
           end
       next
   end

5. Configure another Agentless VPN portal and disable Agentless VPN on it.

   config vpn ssl web portal
       edit "portal-access-disabled"
           set web-mode disable
       next
   end

6. Configure Agentless VPN settings:

   config vpn ssl settings
       set servercert "server_certificate"
       set source-interface "wan1"
       set source-address "all"
       set default-portal "portal-access-disabled"
       config authentication-rule
           edit 1
               set groups "dualPrimaryGroup"
               set portal "agentless-portal"
           next        
       end
   end

7. Configure one Agentless VPN firewall policy to allow remote users to access the internal network. This policy does not allow traffic initiated from internal network to remote client.

   config firewall policy 
      edit 1
           set name "Agentless VPN firewall policy"
           set srcintf "ssl.root"
           set dstintf "port1"
           set srcaddr "all"
           set dstaddr "192.168.1.0"
           set action accept
           set schedule "always"
           set service "ALL"
           set nat enable
           set groups “dualPrimaryGroup”
       next
   end

   To verify the connection:

   User fackeith is a member of the FortiAuthenticator server only.

   User radkeith is a member of both the NPS server and the FortiAuthenticator server, but has different passwords on each server.

   Case 1: Connect to the Agentless VPN web portal using a web browser and authentication with user FacAdmin:

   # diagnose sniffer packet any 'port 1812' 4 0 l

   interfaces=[any]

   filters=[port 1812]

   2020-05-15 17:21:31.217985 port3 out 192.168.20.5.11490 -> 192.168.20.6.1812: udp 118

   2020-05-15 17:21:31.218091 port1 out 192.168.2.5.11490 -> 192.168.2.71.1812: udp 118

   2020-05-15 17:21:31.219314 port3 in 192.168.20.6.1812 -> 192.168.20.5.11490: udp 20 <-- access-reject

   2020-05-15 17:21:31.219519 port3 out 192.168.20.5.11490 -> 192.168.20.6.1812: udp 182

   2020-05-15 17:21:31.220219 port3 in 192.168.20.6.1812 -> 192.168.20.5.11490: udp 42

   2020-05-15 17:21:31.220325 port3 out 192.168.20.5.11490 -> 192.168.20.6.1812: udp 119

   2020-05-15 17:21:31.220801 port3 in 192.168.20.6.1812 -> 192.168.20.5.11490: udp 20

   2020-05-15 17:21:31.236009 port1 in 192.168.2.71.1812 -> 192.168.2.5.11490: udp 20 <--access-accept

   Access is denied by the NPS server because the user does not exist. However, access is accepted by FortiAuthenticator. The end result is the authentication is successful.

   # get vpn ssl monitor

   Agentless VPN Login Users:

   Index   User       Group             Auth Type      Timeout         From       HTTP in/out    HTTPS in/out

   0       fackeith  dualPrimaryGroup   2(1)            292        192.168.2.202      0/0         0/0

   Agentless VPN sessions:

   Index   User       Group                  Source IP      Duration        I/O Bytes       Tunnel/Dest IP

   Case 2: Connect to the Agentless VPN web portal using a web browser and authenticate with user radkeith:

   # diagnose sniffer packet any 'port 1812' 4 0 l

   interfaces=[any]

   filters=[port 1812]

   2020-05-15 17:26:07.335791 port1 out 192.168.2.5.17988 -> 192.168.2.71.1812: udp 118

   2020-05-15 17:26:07.335911 port3 out 192.168.20.5.17988 -> 192.168.20.6.1812: udp 118

   2020-05-15 17:26:07.337659 port3 in 192.168.20.6.1812 -> 192.168.20.5.17988: udp 20 <--access-accept

   2020-05-15 17:26:07.337914 port3 out 192.168.20.5.17988 -> 192.168.20.6.1812: udp 182

   2020-05-15 17:26:07.339451 port3 in 192.168.20.6.1812 -> 192.168.20.5.17988: udp 228

   2020-05-15 17:26:08.352597 port1 in 192.168.2.71.1812 -> 192.168.2.5.17988: udp 20 <--access-reject

   There is a password mismatch for this user on the Secondary RADIUS server. However, even though the authentication was rejected by FortiAuthenticator, it was accepted by Windows NPS. Therefore, the end result is authentication successful.

   # get vpn ssl monitor

   Agentless VPN Login Users:

   Index   User       Group            Auth Type      Timeout         From        HTTP in/out    HTTPS in/out

   0       radkeith  dualPrimaryGroup   2(1)            290        192.168.2.202    0/0           0/0

   Agentless VPN sessions:

   Index   User      Group               Source IP      Duration        I/O Bytes       Tunnel/Dest IP