PSA – Android FortiClient 8.0 – Mixed Authentication Types – IKEv2

Previously if you had wanted to do SAML/RADIUS on FortiClient Android with IKEv2, you had to use certificate based authentication + SAML/RADIUS. This usually meant having a different dial up IPSec VPN for Windows and Android.

It seems now that FortiClient 8.0 for Android allows PSK + SSO auth(Haven't tested RADIUS). No special settings on the FortiGate required. FortiClient was EMS managed.

The documentation for FortiClient 8.0 android still states you require client certificates and can't see any mention of this now working but I'd imagine this would help a lot of people using Forticlient on android.

https://docs.fortinet.com/document/forticlient/8.0.0/android-administration-guide/189805/creating-an-ipsec-vpn-ikev2-connection

VPN Config below.

config vpn ipsec phase1-interface

edit "RemoteUsers"

set type dynamic

set interface "lo.3"

set ike-version 2

set peertype any

set net-device disable

set mode-cfg enable

set ipv4-dns-server1 192.168.1.1

set ipv4-dns-server2 192.168.1.2

set proposal aes256-sha256 aes256gcm-prfsha256

set localid "120"

set dhgrp 31 19 16

set eap enable

set eap-identity send-request

set client-resume enable

set client-resume-interval 120

set transport udp-fallback-tcp

set ipv4-start-ip 10.212.134.10

set ipv4-end-ip 10.212.134.100

set ipv4-netmask 255.255.255.0

set save-password enable

set psksecret <redacted>

next

end