Under Primary Server enter the IP of the RADIUS server again.

Enter the IP address of your RADIUS server under NAS IP.

Select Specify for Authentication method and chose MS-CHAP-v2.

Give your RADIUS server a name (can match Windows server name for easy identifiability). For now, we’ll stick with the FortiGate and a typical AD authentication setup. They even have a dedicated appliance that is specifically designed for authentication offload called the FortiAuthenticator, but we’ll get into that in another article. It’s important to note that Fortinet allows for their FortiToken functionality to scale well above and beyond what we’ll be looking at today. Today, we’ll be using these included ‘FortiTokens’ to setup our VPN. Fortinet provides an included two licenses of FortiToken (Two-Factor Auth) per FortiGate as a way of allowing administrators to experience the power and simplicity of this feature. The example below is designed to show this configuration in the most basic sense, using only the features that come with a standard FortiGate appliance. I wanted to show a real-life example of how we could provide secure multifactor VPN without having to break the bank. The article below has been written to demonstrate the authentication features of the Fortinet security appliance suite, specifically their flagship product, the FortiGate firewall.

Obviously, there are many choices available, but we found only one that had the scalability necessary to start off small and cost effective, and ultimately scale to hundreds if not thousands of users. As a part of our continued efforts to provide technical guidance for our clients, a request was made recently as to whether or not we could provide a highly secure, multifactor authentication methodology for remote VPN users.

Fortigate openvpn