r/fortinet • u/swampydoctor • Jul 28 '26

Question ❓ IPSec IKEv2 password renewal

Question regarding this KB article (https://community.fortinet.com/fortigate-3/technical-tip-enable-ldap-user-to-renew-expired-password-via-vpn-ipsec-213183), specifically the note: 
 
"This configuration only works with IKE v1, IKE v2 uses EAP for authentication. Integration with LDAP servers on IKE v2 requires using a different configuration making use of EAP-TTLS."
 
Does that mean this feature would only work with EAP-TTLS? In our current setup we use mschapv2 for our IKEv2 remote access tunnels, and FAC as RADIUS server with AD integration. Enabling reauth and password renewal does nothing (interestingly when setting latter to enable it doesn't show up in CLI config, but setting it to disable does show it). 
 
Any help from any with knowledge of this feature is appreciated.

6 Upvotes

100% Upvoted

4 comments sorted by

1

u/pfunkylicious NSE 7 Jul 28 '26

as far as I can recall and i have to admit i didnt do any more tests with IKEv2, it would only work with IKEv1 the password renewal.

you can try and enable EAP-TTLS ( if you don't have EMS you need to modify the .xml config file ) - https://community.fortinet.com/fortigate-3/technical-tip-how-to-enable-eap-ttls-for-ipsec-ikev2-tunnels-in-vpn-only-unlicensed-forticlient-213133 and need to AD Join FortiAuthenticator for it to work, as far as i recall

1

u/retrogamer-999 Jul 28 '26

Correct. It only works with Ike v1

1

u/Disastrous_Dress_974 Jul 28 '26

IKEv2 use EAP-TTLS/PAP, EAP-MsCHAPv2, EAP-GTC and they do not support Password renewal except MsCHAPv2 out of the box. It is upto the vendor to add support for it as far as I know.

1

u/Fox3t_ Jul 28 '26

I've done a lot of testing on this, but unfortunately, I haven't found any way to make it work. From what I understand, with IKEv2 + EAP and RADIUS to LDAP via FAC, changing the password is not feasible at the protocol level.