Agentless VPN with RADIUS password renew on FortiAuthenticator

This is a sample configuration of Agentless VPN for RADIUS users with Force Password Change on next logon. In this example, the RADIUS server is a FortiAuthenticator. A user test1 is configured on FortiAuthenticator with Force password change on next logon.

Sample topology

Sample configuration

WAN interface is the interface connected to ISP. This example shows static mode. You can also use DHCP or PPPoE mode. The Agentless VPN connection is established over the WAN interface.

To configure Agentless VPN using the GUI:

1. Configure the interface and firewall address. The port1 interface connects to the internal network.

   1. Go to Network > Interfaces and edit the wan1 interface.

   2. Set IP/Network Mask to 172.20.120.123/255.255.255.0.

   3. Edit port1 interface and set IP/Network Mask to 192.168.1.99/255.255.255.0.

   4. Click OK.

   5. Go to Policy & Objects > Address and create an address for internet subnet 192.168.1.0.

2. Create a RADIUS user.

   1. Go to User & Authentication > RADIUS Servers to create a user.

   2. Set Authentication method to MS-CHAP-v2.

   3. Enter the IP/Name and Secret.

   4. Click Create.

      Password renewal only works with the MS-CHAP-v2 authentication method.

   5. To enable the password-renew option, use these CLI commands.

      config user radius
          edit "fac"
              set server "172.20.120.161"
              set secret <fac radius password>
              set auth-type ms_chap_v2
              set password-renewal enable
          next
      end

3. Configure user group.

   1. Go to User & Authentication > User Groups to create a user group.

   2. For the Name, enter fac-group.

   3. In Remote Groups, click Add to add Remote Server you just created.

4. Configure Agentless VPN portal and predefine RDP bookmark for windows server.

   config vpn ssl web portal
       edit "agentless-portal"
           set web-mode enable
           config bookmark-group
               edit "gui-bookmarks"
                   config bookmarks
                       edit "Windows Server"
                           set apptype rdp
                           set host "192.168.1.114"
                           set port 3389
                           set logon-user "your-windows-server-user-name"
                           set logon-password your-windows-server-password
                       next
                   end
               next
           end
       next
   end

5. Configure another Agentless VPN portal and disable Agentless VPN on it.

   config vpn ssl web portal
       edit "portal-access-disabled"
           set web-mode disable
       next
   end

6. Configure Agentless VPN settings.

   1. Go to VPN > Agentless VPN Settings.

   2. Set Agentless VPN status to Enable.

   3. Set Listen on Interface(s) to wan1.

   4. Set Listen on Port to 10443.

   5. Choose a certificate for Server Certificate. The default is Fortinet_Factory.

   6. In Authentication/Portal Mapping, select All Other Users/Groups, and click Edit.

   7. Use Portal dropdown to select portal-access-disabled.

   8. Click OK.

   9. In Authentication/Portal Mapping, click Create New.

      1. Set Users/Groups to fac-group.

      2. Set Portal to agentless-portal.

      3. Click OK.

   10. Click Apply to save the Agentless VPN settings.

7. Configure Agentless VPN firewall policy.

   1. Go to Policy & Objects > Firewall Policy, and click Create New.

   2. Set Name to Agentless VPN firewall policy.

   3. Set Schedule to always and Action to Accept.

   4. Set Incoming interface to Agentless VPN interface (ssl.root).

   5. Choose an Outgoing Interface. This example uses port1.

   6. Set the Source to all and User/group to fac-group.

   7. In this example, the Destination is the internal, protected subnet 192.168.1.0.

   8. Set Service to ALL.

   9. Click OK.

To configure Agentless VPN using the CLI:

1. Configure the interface and firewall address.

   config system interface 
       edit "wan1"
           set vdom "root"
           set ip 172.20.120.123 255.255.255.0
       next
   end

2. Configure internal interface and protected subnet, then connect the port1 interface to the internal network.

   config system interface
       edit "port1"
           set vdom "root"
           set ip 192.168.1.99 255.255.255.0
       next
   end

   config firewall address
       edit "192.168.1.0"
           set subnet 192.168.1.0 255.255.255.0
       next
   end

3. Configure the RADIUS server.

   config user radius
       edit "fac"
           set server "172.18.58.107"
           set secret <fac radius password>
           set auth-type ms_chap_v2
           set password-renewal enable
       next
   end

4. Configure user group.

   config user group
       edit "fac-group"
           set member "fac"
       next
   end

5. Configure Agentless VPN portal and predefine RDP bookmark for windows server.

   config vpn ssl web portal
       edit "agentless-portal"
           set web-mode enable
           config bookmark-group
               edit "gui-bookmarks"
                   config bookmarks
                       edit "Windows Server"
                           set apptype rdp
                           set host "192.168.1.114"
                           set port 3389
                           set logon-user "your-windows-server-user-name"
                           set logon-password your-windows-server-password
                       next
                   end
               next
           end
       next
   end

6. Configure another Agentless VPN portal and disable Agentless VPN on it.

   config vpn ssl web portal
       edit "portal-access-disabled"
           set web-mode disable
       next
   end

7. Configure Agentless VPN settings.

   config vpn ssl settings
       set servercert "server_certificate"
       set source-interface "wan1"
       set source-address "all"
       set default-portal "portal-access-disabled"
       config authentication-rule
           edit 1
               set groups "fac-group"
               set portal "agentless-portal"
           next        
       end
   end

8. Configure one Agentless VPN firewall policy to allow remote users to access the internal network. This policy does not allow traffic initiated from internal network to remote client.

   config firewall policy 
       edit 1
           set name "Agentless VPN firewall policy"
           set srcintf "ssl.root"
           set dstintf "port1"
           set srcaddr "all"
           set dstaddr "192.168.1.0"
           set action accept
           set schedule "always"
           set service "ALL"
           set nat enable
           set groups “fac-group”
       next
   end

To see the results of web portal:

1. From a remote device, use a web browser to log into the Agentless VPN web portal http://172.20.120.123:10443.

2. Log in using the test1 credentials.

   Use a user which is configured on FortiAuthenticator with Force password change on next logon.

3. Click Login. You are prompted to enter a new password.

4. On the FortiGate, go to Dashboard > Network and expand the Agentless VPN widget to verify the user’s connection.

To check the Agentless VPN connection using the GUI:

1. On FortiGate, go to Dashboard > Agentless VPN Monitor to verify the list of Agentless VPN users.

   If the Agentless VPN Monitor is hidden, click + under the Dashboard, search for Agentless VPN Monitor, and add it to the display.

2. Go to Log & Report > System Events, and use the dropdown to select VPN Events to view VPN logs.

To check the Agentless VPN portal login using the CLI:

get vpn ssl monitor
Agentless VPN Login Users:
 Index   User    Auth Type    Timeout    From           HTTP in/out   HTTPS in/out
 0       test1   1(1)         229        10.1.100.254   0/0           0/0

Agentless VPN sessions:
 Index   User    Source IP      Duration        I/O Bytes       Tunnel/Dest IP