FortiGate IPSec VPN User Guide - FirewallShop.com

Using XAuth authentication
Auto Key phase 1 parameters
3 Select Advanced.
4 Under XAuth, select Enable as Server.
5 The Server Type setting determines the type of encryption method to use between
the XAuth client, the FortiGate unit and the authentication server. Select one of
the following options:
• PAP—Password Authentication Protocol.
• CHAP— Challenge-Handshake Authentication Protocol.
• MIXED—Use PAP between the XAuth client and the FortiGate unit, and CHAP
between the FortiGate unit and the authentication server.
6 From the User Group list, select the user group that needs to access the private
network behind the FortiGate unit. The group must be added to the FortiGate
configuration before it can be selected here.
7 Select OK.
Authenticating the FortiGate unit as a client with XAuth
If the FortiGate unit acts as a dialup client, the remote peer, acting as an XAuth
server, might require a user name and password. You can configure the FortiGate
unit as an XAuth client, with its own user name and password, which it provides
when challenged.
To configure the FortiGate dialup client as an XAuth client
1 At the FortiGate dialup client, go to VPN > IPSEC > Auto Key (IKE).
2 In the list, select the Edit icon of a phase 1 configuration to edit its parameters for
a particular remote gateway.
3 Select Advanced.
4 Under XAuth, select Enable as Client.
5 In the Username field, type the FortiGate PAP, CHAP, RADIUS, or LDAP user
name that the FortiGate XAuth server will compare to its records when the
FortiGate XAuth client attempts to connect.
6 In the Password field, type the password to associate with the user name.
7 Select OK.
FortiGate IPSec VPN Version 3.0 User Guide
142 01-30005-0065-20070716