fortigate-ipsec-40-mr3

Auto Key phase 1 parameters Using XAuth authentication
5 The Server Type setting determines the type of encryption method to use between the
XAuth client, the FortiGate unit and the authentication server. Select one of the
following options:
PAP—Password Authentication Protocol.
CHAP— Challenge-Handshake Authentication Protocol.
AUTO—Use PAP between the XAuth client and the FortiGate unit, and CHAP
between the FortiGate unit and the authentication server.
6 From the User Group list, select the user group that needs to access the private
network behind the FortiGate unit. The group must be added to the FortiGate
configuration before it can be selected here.
7 Select OK.
Using the FortiGate unit as an XAuth client
If the FortiGate unit acts as a dialup client, the remote peer, acting as an XAuth server,
might require a user name and password. You can configure the FortiGate unit as an
XAuth client, with its own user name and password, which it provides when challenged.
To configure the FortiGate dialup client as an XAuth client
1 At the FortiGate dialup client, go to VPN > IPsec > Auto Key (IKE).
2 In the list, select a phase 1 configuration and select Edit.
3 Select Advanced.
4 Under XAuth, select Enable as Client.
5 In the Username field, type the FortiGate PAP, CHAP, RADIUS, or LDAP user name
that the FortiGate XAuth server will compare to its records when the FortiGate XAuth
client attempts to connect.
6 In the Password field, type the password to associate with the user name.
7 Select OK.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 55
http://docs.fortinet.com/