Using single or multiple user groups for user authentication

User groups enable remote users to authenticate themselves before establishing a connection to the IPsec VPN tunnel. One or more user groups for user authentication can be configured under a single IPsec VPN tunnel. For information about configuring user groups, see User groups.

When configuring dialup or remote access IPsec VPNs, user groups can be specified in either the phase 1 settings or the firewall policy associated with the tunnel. They must not be configured in both.

The workflow for configuring user groups varies depending on whether the IPsec tunnel is set up using the VPN Wizard or a custom IPsec configuration.

VPN Wizard IPsec tunnel configuration

When configuring the tunnel, you can specify one or more user groups in the User authentication method option.

• Single user group:

  Set User Authentication Method to either:

  • Phase 1 Interface: Select the required user group.

  • Inherit from Policy: Select the user group, which will automatically populate the User/Group fields in the firewall policies created by the wizard.

• Multiple user groups:

  Set User Authentication Method to Inherit from Policy and select the required user groups. These will be added to the User/Group fields in the firewall policies created by the wizard.

• For any additional firewall policies created outside the VPN Wizard, administrators must manually assign the appropriate user group or groups in the User/Group fields.

Custom IPsec tunnel configuration

The custom IPsec tunnel configuration offers more granular settings to configure IPsec VPN. To configure a custom IPsec VPN tunnel, go to VPN > VPN Tunnels and click Create New > Custom IPsec tunnel.

• Single user group:

  • GUI:

    In the VPN tunnel configuration, enable XAUTH for IKEv1 or EAP for IKEv2, and either:

    • Set User Group to Specify and select the required user group, or

    • Set User Group to Inherit from Policy and in the policy configuration, specify the user group in the User/group field.

  • CLI:

    For IKEv1, enable XAUTH:

    config vpn ipsec phase1-interface
        edit <tunnel-name>
            set xauthtype {pap | chap | auto}
        next
    end
    

    For IKEv2, enable EAP:

    config vpn ipsec phase1-interface
        edit <tunnel-name>
            set eap enable
            set eap-identity send-request
        next
    end

    In the VPN tunnel configuration, either:

    • Set the user group (set authusrgrp <group-name>), or

    • Remove any configured user group (unset authusrgrp), then specify the user group in the firewall policy (set groups <group-name>).

• Multiple user groups:

  • GUI:

    In the VPN tunnel configuration, enable XAUTH for IKEv1 or EAP for IKEv2, and set User Group to Inherit from Policy. In the policy configuration, specify the user groups in the User/group field.

  • CLI:

    For IKEv1, enable XAUTH:

    config vpn ipsec phase1-interface
        edit <tunnel-name>
            set xauthtype {pap | chap | auto}
        next
    end
    

    For IKEv2, enable EAP:

    config vpn ipsec phase1-interface
        edit <tunnel-name>
            set eap enable
            set eap-identity send-request
        next
    end

    In the VPN tunnel configuration, remove any configured user group (unset authusrgrp), then specify the user groups in the firewall policy (set groups <group-name> ... <group-name>).

Starting with FortiClient 7.4.4, IKEv1 is no longer supported on the client. Therefore, plan accordingly when choosing your IKE version. Use IKEv2 if you plan on deploying FortiClient 7.4.4 and later. Also, FortiClient 7.4.4 does not support IPv6.