Introduction
If you are migrating from SSL VPN to IPsec Dialup VPN on FortiGate firewalls, one of the first things to check is how your chosen IKE version interacts with your user database and MFA method. The combination you pick directly affects whether FortiToken will work for two-factor authentication.
Compatibility Overview
The table below summarises the key combinations of IKE version and user database, and whether FortiToken MFA is supported:
| Sl No. | IKE Version | User Database | FortiToken / MFA Status |
|---|---|---|---|
| 1 | IKEv1 | LDAP | ⚠️ Will have issues with FortiToken |
| 2 | IKEv1 | Radius | ✅ Can work with FortiToken |
| 3 | IKEv2 | LDAP | ❌ Cannot map a user with group |
| 4 | IKEv2 | Radius | ✅ Can work |
IKEv1 with LDAP — FortiToken Workaround
IKEv1 uses the Xauth authentication method, which transmits user credentials in plain text. This means it can work with LDAP as long as MFA is not involved. However, IKEv1 LDAP authentication will not work for standard 2FA with FortiToken.
If you need MFA with IKEv1, the workaround is to use a Concatenate Password and Token approach: instruct users to enter their credentials by combining their password and FortiToken code together in the password field.
For example, if the password is Password123 and the FortiToken code is 654321, the user types Password123654321 in the password field.
IKEv2 with LDAP — Why It Fails
IKEv2 authentication fails with standard LDAP (Active Directory) because of a fundamental cryptographic mismatch between how IKEv2 handles passwords and how LDAP verifies them.
- IKEv2 uses EAP authentication, where the user password is shared as a hashed cryptographic challenge.
- LDAP requires a plain text password to authenticate users.
- Because of this mismatch, IKEv2 is not compatible with LDAP authentication by default.
- This also means you cannot map a user to a group when using IKEv2 with LDAP.
IKEv2 with LDAP — Workaround
If your environment requires IKEv2 with LDAP, there is a workaround available, but it comes with strict version requirements:
- FortiOS version: 7.4.4 or higher
- FortiClient version: 7.4.4 or higher
- Change the user authentication settings from MSCHAPv2 to EAP-TTLS authentication.
Best Practice Recommendation
If your environment and infrastructure allow it, the best alternative is to use Radius / NPS instead of LDAP for IPsec VPN authentication. Radius works with both IKEv1 and IKEv2 and is fully compatible with FortiToken MFA, avoiding the cryptographic limitations that affect LDAP-based authentication.
Conclusion
When migrating from SSL VPN to IPsec Dialup VPN on FortiGate, choose your IKE version and user database combination carefully. IKEv1 with Radius and IKEv2 with Radius are the most reliable combinations for FortiToken MFA. If LDAP is required, apply the appropriate workaround based on your FortiOS and FortiClient versions.
Ask Your Doubt