Agentless VPN with LDAP-integrated certificate authentication

This is a sample configuration of Agentless VPN that requires users to authenticate using a certificate with LDAP UserPrincipalName checking.

This sample uses Windows 2012R2 Active Directory acting as both the user certificate issuer, the certificate authority, and the LDAP server.

When configuring an LDAP connection to an Active Directory server, an administrator must provide Active Directory user credentials. To secure this connection, use LDAPS on both the Active Directory server and FortiGate. See Configuring an LDAP server and Configuring client certificate authentication on the LDAP server. Apply the principle of least privilege. For the LDAP regular bind operation, do not use credentials that provide full administrative access to the Windows server when using credentials. See Configuring least privileges for LDAP admin account authentication in Active Directory.

Sample topology

Sample configuration

WAN interface is the interface connected to ISP. This example shows static mode. You can also use DHCP or PPPoE mode. The Agentless VPN connection is established over the WAN interface.

In this sample, the User Principal Name is included in the subject name of the issued certificate. This is the user field we use to search LDAP in the connection attempt.

To use the user certificate, you must first install it on the user’s PC. When the user tries to authenticate, the user certificate is checked against the CA certificate to verify that they match.

Every user should have a unique user certificate. This allows you to distinguish each user and revoke a specific user’s certificate, such as if a user no longer has VPN access.

To install the server certificate:

The server certificate is used for authentication and for encrypting Agentless VPN traffic.

1. Go to System > Feature Visibility and ensure Certificates is enabled.

2. Go to System > Certificates and select Import > Local Certificate.

3. Set Type to Certificate.

4. Choose the Certificate file and the Key file for your certificate, and enter the Password.

5. If required, change the Certificate Name.

   The server certificate now appears in the list of Certificates.

To install the CA certificate:

The CA certificate is the certificate that signed both the server certificate and the user certificate. In this example, it is used to authenticate Agentless VPN users.

1. Go to System > Certificates and select Import > CA Certificate.

2. Select Local PC and then select the certificate file.

   The CA certificate now appears in the list of External CA Certificates. In this example, it is called CA_Cert_1.

To configure Agentless VPN using the GUI:

1. Configure the interface and firewall address. The port1 interface connects to the internal network.

   1. Go to Network > Interfaces and edit the wan1 interface.

   2. Set IP/Network Mask to 172.20.120.123/255.255.255.0.

   3. Edit port1 interface and set IP/Network Mask to 192.168.1.99/255.255.255.0.

   4. Click OK.

   5. Go to Policy & Objects > Address and create an address for internet subnet 192.168.1.0.

2. Configure the LDAP server:

   1. Go to User & Authentication > LDAP Servers and click Create New.

   2. Specify Name and Server IP/Name.

   3. Set Distinguished Name to dc=fortinet-fsso,dc=com.

   4. Set Bind Type to Regular.

   5. Set Username to cn=admin,ou=testing,dc=fortinet-fsso,dc=com.

   6. Set Password.

   7. Click OK.

3. Configure PKI users and a user group:

   To use certificate authentication, use the CLI to create PKI users.

   config user peer
       edit user1
           set ca CA_Cert_1
           set mfa-server "ldap-AD"
           set mfa-mode subject-identity
       next
   end

   When you have create a PKI user, a new menu is added to the GUI:

   1. Go to User & Authentication > PKI to see the new user.

   2. Go to User & Authentication > User > User Groups and create a group agentlessvpn-group.

   3. Add the PKI peer object you created as a local member of the group.

   4. Add a remote group on the LDAP server and select the group of interest.

      You need these users to be members using the LDAP browser window.

4. Configure Agentless VPN portals.

   1. Go to VPN > Agentless VPN Portals, and click Create New.

   2. Enter a name, such as agentless-portal.

   3. Under Predefined Bookmarks, click Create New, and enter the following details:

      Field	Value
      Name	Windows Server
      Type	RDP
      Host	192.168.1.114
      Port	3389
      Single Sign-On	Disable
      Username	Set the username to log in to Windows Server.
      Password	Set the password to log in to Windows Server.
      Port	3389

   4. Click OK to save the predefined bookmark.

   5. Click OK to save the portal settings.

   6. Create another Agentless VPN portal and name it portal-access-disabled.

   7. Click OK to save the portal settings.

   8. Disable Agentless VPN for the newly created portal (that is, portal-access-disabled) using CLI:

      config vpn ssl web portal
          edit "portal-access-disabled"
              set web-mode disable
          next
      end

5. Configure Agentless VPN settings:

   1. Go to VPN > Agentless VPN Settings.

   2. Select the Listen on Interface(s), in this example, wan1.

   3. Set Listen on Port to 10443.

   4. Set Server Certificate to the authentication certificate.

      1. In Authentication/Portal Mapping, select All Other Users/Groups, and click Edit.

      2. Use Portal dropdown to select portal-access-disabled.

      3. Click OK.

   5. In Authentication/Portal Mapping, click Create New.

      1. Set Users/Groups to agentlessvpn-group.

      2. Set Portal to agentless-portal.

      3. Click OK.

   6. Click Apply to save the Agentless VPN settings.

6. Configure Agentless VPN firewall policy.

   1. Go to Policy & Objects > Firewall Policy, and click Create New.

   2. Set Name to Agentless VPN firewall policy.

   3. Set Schedule to always and Action to Accept.

   4. Set Incoming interface to Agentless VPN interface (ssl.root).

   5. Choose an Outgoing Interface. This example uses port1.

   6. Set the Source to all and User/group to agentlessvpngroup.

   7. In this example, the Destination is the internal, protected subnet 192.168.1.0.

   8. Set Service to ALL.

   9. Click OK.

To configure Agentless VPN using the CLI:

1. Configure the interface and firewall address:

   config system interface 
       edit "wan1"
           set vdom "root"
           set ip 172.20.120.123 255.255.255.0
       next
   end

2. Configure internal interface and protected subnet, then connect the port1 interface to the internal network:

   config system interface
       edit "port1"
           set vdom "root"
           set ip 192.168.1.99 255.255.255.0
       next
   end

   config firewall address
       edit "192.168.1.0"
           set subnet 192.168.1.0 255.255.255.0
       next
   end

3. Configure the LDAP server:

   config user ldap
       edit "ldap-AD"
           set server "172.18.60.206"
           set cnid "cn"
           set dn "dc=fortinet-fsso,dc=com"
           set type regular
           set username "cn=admin,ou=testing,dc=fortinet-fsso,dc=com"
           set password ldap-server-password
       next
   end

4. Configure PKI users and a user group:

   config user peer
       edit user1
           set ca CA_Cert_1
           set mfa-server "ldap-AD"
           set mfa-mode subject-identity
       next
   end

   config user group
       edit "agentlessvpn-group"
           set member "ldap-AD" "user1"
           config match
               edit 1
                   set server-name "ldap-AD"
                   set group-name "CN=group3,OU=Testing,DC=Fortinet-FSSO,DC=COM"
               next
           end
       next
   end

5. Configure Agentless VPN portal and predefine RDP bookmark for windows server.

   config vpn ssl web portal
       edit "agentless-portal"
           set web-mode enable
           config bookmark-group
               edit "gui-bookmarks"
                   config bookmarks
                       edit "Windows Server"
                           set apptype rdp
                           set host "192.168.1.114"
                           set port 3389
                           set logon-user "your-windows-server-user-name"
                           set logon-password your-windows-server-password
                       next
                   end
               next
           end
       next
   end

6. Configure another Agentless VPN portal and disable Agentless VPN on it.

   config vpn ssl web portal
       edit "portal-access-disabled"
           set web-mode disable
       next
   end

7. Configure Agentless VPN settings:

   config vpn ssl settings
       set servercert "server_certificate"    
       set source-interface "wan1"
       set source-address "all"
       set default-portal "agentless-portal"
       config authentication-rule
           edit 1
               set groups "agentlessvpn-group"
               set portal "agentless-portal"
           next        
       end
   end

8. Configure one Agentless VPN firewall policy to allow remote user to access the internal network. This policy does not allow traffic initiated from internal network to remote client.

   config firewall policy 
       edit 1
           set name "Agentless VPN firewall policy"
           set srcintf "ssl.root"
           set dstintf "port1"
           set srcaddr "all"
           set dstaddr "192.168.1.0"        
           set action accept
           set schedule "always"
           set service "ALL"
           set nat enable
           set groups "agentlessvpngroup"
       next
   end

To see the results of Agentless VPN portal:

1. In a web browser, log into the portal http://172.20.120.123:10443.

   A message requests a certificate for authentication.

2. Select the user certificate. It does not require username and password.

   You can connect to the Agentless VPN web portal.

To check the Agentless VPN connection using the GUI:

1. On FortiGate, go to Dashboard > Agentless VPN Monitor to verify the list of Agentless VPN users.

   If the Agentless VPN Monitor is hidden, click + under the Dashboard, search for Agentless VPN Monitor, and add it to the display.

2. Go to Log & Report > System Events, and use the dropdown to select VPN Events to view VPN logs.

To check the Agentless VPN connection using the CLI:

get vpn ssl monitor
Agentless VPN Login Users:
 Index   User    Auth Type      Timeout         From     HTTP in/out    HTTPS in/out
 0       test3          1(1)            229     10.1.100.254   0/0     0/0

Agentless VPN sessions:
 Index   User    Source IP      Duration        I/O Bytes       Tunnel/Dest IP

To check the real-time authentication debug logs using the CLI:

Below is a sample output of diagnose debug application fnbamd -1 while the user connects. This is a shortened output sample of a few locations to show the important parts. This sample shows lookups to find the group memberships (three groups total) of the user and that the correct group being found results in a match.

[1148] fnbamd_ldap_recv-Response len: 16, svr: 172.18.60.206
[829] fnbamd_ldap_parse_response-Got one MESSAGE. ID:4, type:search-result
[864] fnbamd_ldap_parse_response-ret=0
[1386] __fnbamd_ldap_primary_grp_next-Auth accepted
[910] __ldap_rxtx-Change state to 'Done'
[843] __ldap_rxtx-state 23(Done)
[925] fnbamd_ldap_send-sending 7 bytes to 172.18.60.206
[937] fnbamd_ldap_send-Request is sent. ID 5
[753] __ldap_stop-svr 'ldap-AD'
[53] ldap_dn_list_del_all-Del CN=test3,OU=Testing,DC=Fortinet-FSSO,DC=COM
[399] ldap_copy_grp_list-copied CN=group3,OU=Testing,DC=Fortinet-FSSO,DC=COM
[399] ldap_copy_grp_list-copied CN=Domain Users,CN=Users,DC=Fortinet-FSSO,DC=COM
[2088] fnbamd_auth_cert_check-Matching group 'agentlessvpn-group'
[2007] __match_ldap_group-Matching server 'ldap-AD' - 'ldap-AD'
[2015] __match_ldap_group-Matching group 'CN=group3,OU=Testing,DC=Fortinet-FSSO,DC=COM' - 'CN=group3,OU=Testing,DC=Fortinet-FSSO,DC=COM'
[2091] fnbamd_auth_cert_check-Group 'agentlessvpn-group' matched
[2120] fnbamd_auth_cert_result-Result for ldap svr[0] 'ldap-AD' is SUCCESS
[2126] fnbamd_auth_cert_result-matched user 'test3', matched group 'agentlessvpn-group'

You can also use diagnose firewall auth list to validate that a firewall user entry exists for the Agentless VPN user and is part of the right groups.