Configuring LDAP Authentication for IPsec VPN on FortiGate
A FortiGate administrator wants to authenticate VPN users against an existing LDAP server. The administrator creates an LDAP user group on the FortiGate. What additional configuration is REQUIRED to use this group for IPsec VPN authentication?
Quick Answer
The correct answer is to configure the IPsec Phase 1 interface with the peer type set to 'dialup' and then specify the LDAP user group under the authentication settings. This is required because LDAP authentication for IPsec VPN on FortiGate relies on the Phase 1 configuration to define how remote users are validated; the user group created from the LDAP server must be explicitly referenced in the Phase 1 'Peer Options' or 'User Authentication' section (often by setting xauthtype to 'auto' and selecting the group under usrgrp) so the FortiGate knows which directory users to accept. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this tests your understanding of how authentication flows from the LDAP server through the user group to the VPN tunnel—a common trap is forgetting that creating the group alone is insufficient; it must be linked in Phase 1. Memory tip: think "Phase 1 is the door, the user group is the key—without setting dialup and selecting the group, the door won't recognize the key."
⚠ Common exam trap
It's easy for candidates to confuse the authentication configuration (Phase 1) with the authorization configuration (firewall policies), leading them to select Option C, thinking that assigning the group to a policy is sufficient for VPN authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the IPsec Phase 1 configuration, set the peer type to 'dialup' and specify the user group under authentication
For IPsec VPN authentication, the FortiGate must know which users are allowed to connect. Setting the peer type to 'dialup' in Phase 1 enables the FortiGate to accept connections from remote users rather than another gateway. Specifying the LDAP user group under authentication tells the FortiGate to validate the VPN user's credentials against that group's members, which are resolved via the LDAP server. Without this configuration, the FortiGate has no way to associate the LDAP group with the VPN tunnel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
In the IPsec Phase 1 configuration, set the peer type to 'dialup' and specify the user group under authentication
Why this is correct
For dial-up IPsec VPN, the Phase 1 configuration must include the user group to authenticate users against LDAP.
- ✗
Enable LDAP over TLS (LDAPS) on the FortiGate
Why it's wrong here
LDAPS is about encryption, not a requirement for authentication to work; it's optional.
- ✗
Assign the LDAP user group to a firewall policy
Why it's wrong here
The firewall policy uses the group for traffic matching, but for VPN authentication, the group must be specified in Phase 1.
- ✗
Configure a RADIUS server as an intermediate proxy between FortiGate and LDAP
Why it's wrong here
FortiGate can authenticate directly against LDAP without RADIUS.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network administrator wants to authenticate VPN users against an existing LDAP server. Which authentication method should be configured on the FortiGate?
easy- A.FSSO
- ✓ B.LDAP
- C.RADIUS
- D.Local
Why B: To authenticate VPN users against an existing LDAP server, the FortiGate must be configured to query the LDAP directory directly for user credentials. The LDAP authentication method (option B) allows the FortiGate to bind to the LDAP server using the user's DN and password, verifying identity against the directory. This is the correct choice because the question explicitly specifies an LDAP server, and FortiGate supports native LDAP authentication for SSL/IPsec VPNs without requiring an intermediate RADIUS or FSSO server.
Variation 2. An administrator wants to authenticate VPN users against an external LDAP server. Which authentication method should be configured in the user group for the SSL VPN portal?
easy- A.RADIUS
- B.FSSO
- C.Local
- ✓ D.LDAP
Why D: To authenticate VPN users against an external LDAP server, the user group for the SSL VPN portal must be configured with the LDAP authentication method. This directs FortiGate to bind directly to the LDAP server (e.g., Active Directory or OpenLDAP) using the configured LDAP server object, performing a simple bind or SASL bind to verify user credentials. Other methods like RADIUS, FSSO, or Local would not leverage the LDAP server directly.
Variation 3. A FortiGate administrator needs to authenticate VPN users against an LDAP server. What is the primary purpose of the 'CN=,OU=,DC=' distinguished name (DN) configured in the LDAP server settings?
easy- A.It is used to encrypt LDAP communication
- B.It defines the IP address of the LDAP server
- C.It specifies the base DN for searching users
- ✓ D.It specifies the bind user credentials to connect to the LDAP server
Why D: The DN configured in the LDAP server settings on FortiGate specifies the bind user credentials (username and password) that the FortiGate uses to authenticate itself to the LDAP server before performing user searches. This bind DN is required because LDAP servers typically require a valid authenticated session to query the directory; the bind DN provides the necessary identity and privileges for the FortiGate to search for VPN users.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.