Agentless VPN with RADIUS and FortiToken mobile push on FortiAuthenticator

This is a sample configuration of Agentless VPN that uses FortiAuthenticator as a RADIUS authentication server and FortiToken mobile push two-factor authentication. If you enable push notifications, users can accept or deny the authentication request.

Sample topology

Sample configuration

WAN interface is the interface connected to ISP. This example shows static mode. You can also use DHCP or PPPoE mode. The Agentless VPN connection is established over the WAN interface.

To configure FortiAuthenticator using the GUI:

1. On the FortiAuthenticator, go to System > Administration > System Access and configure a Public IP/FQDN for FortiToken Mobile. If the FortiAuthenticator is behind a firewall, the public IP/FQDN will be an IP/port forwarding rule directed to one of the FortiAuthenticator interfaces. The interface that receives the approve/deny FTM push responses must have the FortiToken Mobile API service enabled.

2. Add a FortiToken mobile license on the FortiAuthenticator:

   1. Go to Authentication > User Management > FortiTokens.

   2. Click Create New.

   3. Set Token type to FortiToken Mobile and enter the FortiToken Activation codes.

3. Create the RADIUS client (FortiGate) on the FortiAuthenticator:

   1. Go to Authentication > RADIUS Service > Clients to add the FortiGate as a RADIUS client OfficeServer).

   2. Enter the FortiGate IP address and set a Secret.

      The secret is a pre-shared secure password that the FortiGate uses to authenticate to the FortiAuthenticator.

   3. Set Authentication method to Enforce two-factor authentication.

   4. Select Enable FortiToken Mobile push notifications authentication.

   5. Set Realms to local | Local users.

4. Create a user and assign FortiToken mobile to the user on the FortiAuthenticator:

   1. Go to Authentication > User Management > Local Users to create a user agentlessvpnuser1.

   2. Enable Allow RADIUS authentication and click OK to access additional settings.

   3. Enable Token-based authentication and select to deliver the token code by FortiToken.

   4. Select the FortiToken added from the FortiToken Mobile dropdown menu.

   5. Set Delivery method to Email and fill in the User Information section.

   6. Go to Authentication > User Management > User Groups to create a group agentlessvpngroup.

   7. Add agentlessvpnuser1 to the group by moving the user from Available users to Selected users.

5. Install the FortiToken mobile application on your Android or iOS smartphone.

   The FortiAuthenticator sends the FortiToken mobile activation to the user’s email address.

6. Activate the FortiToken mobile through the FortiToken mobile application by entering the activation code or scanning the QR code.

To configure Agentless VPN using the GUI:

1. Configure the interface and firewall address. The port1 interface connects to the internal network.

   1. Go to Network > Interfaces and edit the wan1 interface.

   2. Set IP/Network Mask to 172.20.120.123/255.255.255.0.

   3. Edit port1 interface and set IP/Network Mask to 192.168.1.99/255.255.255.0.

   4. Click OK.

   5. Go to Policy & Objects > Address and create an address for internet subnet 192.168.1.0.

2. Create a RADIUS user and user group:

   1. On the FortiGate, go to User & Authentication > RADIUS Servers to create a user to connect to the RADIUS server (FortiAuthenticator).

   2. For Name, use FAC-RADIUS.

   3. Enter the IP address of the FortiAuthenticator, and enter the Secret created above.

   4. Click Test Connectivity to ensure you can connect to the RADIUS server.

   5. Select Test User Credentials and enter the credentials for agentlessvpnuser1.

      The FortiGate can now connect to the FortiAuthenticator as the RADIUS client.

   6. Go to User & Authentication > User Groups and click Create New to map authenticated remote users to a user group on the FortiGate.

   7. For Name, use AgentlessVPNGroup.

   8. In Remote Groups, click Add.

   9. In the Remote Server dropdown list, select FAC-RADIUS.

   10. Leave the Groups field blank.

3. Configure Agentless VPN portals.

   1. Go to VPN > Agentless VPN Portals, and click Create New.

   2. Enter a name, such as agentless-portal.

   3. Under Predefined Bookmarks, click Create New, and enter the following details:

      Field	Value
      Name	Windows Server
      Type	RDP
      Host	192.168.1.114
      Port	3389
      Single Sign-On	Disable
      Username	Set the username to log in to Windows Server.
      Password	Set the password to log in to Windows Server.
      Port	3389

   4. Click OK to save the predefined bookmark.

   5. Click OK to save the portal settings.

   6. Create another Agentless VPN portal and name it portal-access-disabled.

   7. Click OK to save the portal settings.

   8. Disable Agentless VPN for the newly created portal (that is, portal-access-disabled) using CLI:

      config vpn ssl web portal
          edit "portal-access-disabled"
              set web-mode disable
          next
      end

4. Configure Agentless VPN settings:

   1. Go to VPN > Agentless VPN Settings.

   2. Set Agentless VPN status to Enable.

   3. Set Listen on Interface(s) to wan1.

   4. Set Listen on Port to 10443.

   5. Choose a certificate for Server Certificate. The default is Fortinet_Factory.

   6. In Authentication/Portal Mapping, select All Other Users/Groups, and click Edit.

   7. Use Portal dropdown to select portal-access-disabled.

   8. Click OK.

   9. In Authentication/Portal Mapping, click Create New.

      1. Set Users/Groups to AgentlessVPNgroup.

      2. Set Portal to agentless-portal.

      3. Click OK.

   10. Click Apply to save the Agentless VPN settings.

5. Configure Agentless VPN firewall policy.

   1. Go to Policy & Objects > Firewall Policy, and click Create New.

   2. Set Name to Agentless VPN firewall policy.

   3. Set Schedule to always and Action to Accept.

   4. Set Incoming interface to Agentless VPN interface (ssl.root).

   5. Choose an Outgoing Interface. This example uses port1.

   6. Set the Source to all and User/group to AgentlessVPNGroup.

   7. In this example, the Destination is the internal, protected subnet 192.168.1.0.

   8. Set Service to ALL.

   9. Enable NAT.

   10. Configure any remaining firewall and security options as desired.

   11. Click OK.

To configure Agentless VPN using the CLI:

1. Configure the interface and firewall address:

   config system interface 
       edit "wan1"
           set vdom "root"
           set ip 172.20.120.123 255.255.255.0
       next
   end

2. Configure internal interface and protected subnet, then connect the port1 interface to the internal network:

   config system interface
       edit "port1"
           set vdom "root"
           set ip 192.168.1.99 255.255.255.0
       next
   end

   config firewall address
       edit "192.168.1.0"
           set subnet 192.168.1.0 255.255.255.0
       next
   end

3. Create a RADIUS user and user group:

   config user radius
       edit "FAC-RADIUS"
           set server "172.20.120.161"
           set secret <FAC client secret>
       next
   end
   

   config user group
       edit "sslvpngroup"
           set member "FAC-RADIUS"
       next
   end

4. Configure Agentless VPN portal and predefine RDP bookmark for windows server.

   config vpn ssl web portal
       edit "agentless-portal"
           set web-mode enable
           config bookmark-group
               edit "gui-bookmarks"
                   config bookmarks
                       edit "Windows Server"
                           set apptype rdp
                           set host "192.168.1.114"
                           set port 3389
                           set logon-user "your-windows-server-user-name"
                           set logon-password your-windows-server-password
                       next
                   end
               next
           end
       next
   end

5. Configure another Agentless VPN portal and disable Agentless VPN on it.

   config vpn ssl web portal
       edit "portal-access-disabled"
           set web-mode disable
       next
   end

6. Configure Agentless VPN settings:

   config vpn ssl settings
       set banned-cipher SHA1 SHA256 SHA384
       set servercert "server_certificate"
       set port 1443
       set source-interface "wan1"
       set source-address "all"
       set default-portal "portal-access-disabled"
       config authentication-rule
           edit 1
               set groups "agentlessvpngroup"
               set portal "agentless-portal"
           next        
       end
   end

7. Configure one Agentless VPN firewall policy to allow remote user to access the internal network:

   config firewall policy 
       edit 1
           set name "Agentless VPN firewall policy"
           set srcintf "ssl.root"
           set dstintf "port1"
           set srcaddr "all"
           set dstaddr "192.168.1.0"
           set action accept
           set schedule "always"
           set service "ALL"
           set nat enable
           set groups “agentlessvpngroup”
       next
   end

To see the results of web portal:

1. From a remote device, use a web browser to log into the Agentless VPN web portal http://172.20.120.123:10443.

2. Log in using the agentlessvpnuser1 credentials.

   The FortiAuthenticator pushes a login request notification through the FortiToken Mobile application.

3. Check your mobile device and select Approve.

   When the authentication is approved, agentlessvpnuser1 is logged into the Agentless VPN portal.

To check the Agentless VPN connection using the GUI:

1. On FortiGate, go to Dashboard > Agentless VPN Monitor to verify the list of Agentless VPN users.

   If the Agentless VPN Monitor is hidden, click + under the Dashboard, search for Agentless VPN Monitor, and add it to the display.

2. Go to Log & Report > System Events, and use the dropdown to select VPN Events to view VPN logs.

To check the Agentless VPN portal login using the CLI:

get vpn ssl monitor
Agentless VPN Login Users:
 Index   User          Auth Type   Timeout   From           HTTP in/out   HTTPS in/out
 0       agentlessvpnuser1   1(1)        229       10.1.100.254   0/0           0/0

Agentless VPN sessions:
 Index   User    Source IP      Duration        I/O Bytes       Tunnel/Dest IP