u/szczebrzeszyn09

Unfortunately, the option to assign an IP address to a user is not working. In the RADIUS test on the firewall, I can see that it receives an IP address along with the user’s details. Unfortunately, the address is not assigned to the tunnel and the user is allocated an address from the pool. On Windows, RADIUS EAP-MSCHAPv2 is included in the Windows configuration. On the firewall, in the ph1 configuration, I have `set assign-ip-from usrgrp`.

Now, one more question. Should the addresses to be assigned to the user come from the pool

`set ipv4-start-ip 10.xxx.xxx.1`

set ipv4-end-ip 10.xxx.xxx.254

Or should they be outside this range? I’ve tested both approaches. Neither of them worked.

I have an idea for setting up an IPSec v2 connection on FortiGate 7.4.

Users are authenticated via RADIUS+MFA using a Forti Token.

At the same time, FortiGate is linked to a Windows Certificate Server. The aim is to verify certificates for computers created in Active Directory.

When a user connects via IPSec, their computer’s certificate is verified; if it matches, the user can then enter their password and token. The connection is then established.

I have EMS (we can use it)

Does anyone have a similar setup?

I have the following problem. I have an SSL VPN that is working correctly. When a user logs in to their computer and connects to the SSL VPN, they move from off-fabric to on-fabric. The SSL VPN connection is maintained correctly and is not disconnected.

However, with an IPSec VPN, the connection is terminated on the IPSec client side. FortiClient is controlled by EMS. What should I select or add to the XML to prevent the VPN from being disconnected?

I’m trying to set up a remote IPSec VPN for my users, but I’m having trouble. I can see that client authorisation is proceeding correctly, but it crashes at the final stage of client authentication.

I’m getting the following error:

ike V=root:0:XXXXX_XXXXX: ignoring IKEv2 request, no policy configured

RADIUS authentication is working correctly.

edit "XXXXX_XXXXXX"

set type dynamic

set interface "VLAN_AA"

set ike-version 2

set local-gw yyy.yyy.yyy.yyy

set peertype any

set net-device enable

set mode-cfg enable

set ipv4-dns-server1 zzz.zzz.zzz.zzz

set proposal aes256-sha256

set dpd on-idle

set dhgrp 14

set eap enable

set eap-identity send-request

set authusrgrp "YYYYYYY"

set ipv4-start-ip aaa.aaa.aaa.aaa

set ipv4-end-ip aaa.aaa.aaa.aaa

set psksecret ENC XXXXXXXXXXXXXXXXXXXXXXXXxx

set dpd-retryinterval 60

next

end

edit "XXXXX_XXXXXX"

set phase1name "XXXXX_XXXXXX"

set proposal aes256-sha256

set dhgrp 14

set keepalive enable

next

A visit to a farm run by Polish citizens near Słonim

The History of Belarus in Polish