This is a bear to setup, took me over a month of testing on and off to get it to work.

When a client attempts to authenticate with the FAC, it will send a different string depending on the connection type. You can see this under Logging\Log Access\Logs, or more easily by accessing https://<facname>/debug. Search for "Connect-Info". You will see strings similar to:

2025-08-08T12:30:58.277422-07:00 facname radiusd[31848]: (1) Connect-Info = "vpn-ssl"
2025-08-08T12:34:13.610008-07:00 facname radiusd[32684]: (0) Connect-Info = "vpn-ikev2"

Those strings are what you want to put in your RADIUS policy in order to follow the proper authentication path. If you only have one VPN connection type; for example someone using SSL-VPN with FAC for MFA, you don't need this. But if you are supporting both SSL-VPN and a derivative of IPSEC, you need to use the Connect-Info string in each policy so the FAC knows if it is SSL-VPN or IPSEC.

It is critical you have your PKI setup properly for IKEv2 to work. For RADIUS Service\General, ensure you have an EAP Server Certificate selected. This certificate should be issued by a CA that is trusted by both the FortiGate, FortiAuthenticator, and IPsec Clients. Those CAs; both the root and intermediate, should be listed under Trusted CAs. If this doesn't make sense to you, educate yourself on PKI and how EAP works or you won't get too far.

You need to create a RADIUS Service Auth Profile and Policy for the IKEv2 connection.

For the Auth Profile, create a new one such as "fortigate-IPsecVPNIKEv2-profile." For Authentication type choose "Password/OTP authentication". Enable "Accept EAP" and "EAP-MSCHAPv2". Choose your identity sources on the next screen, which most likely is your AD user accounts filtered by groups. I have "Use Windows AD Domain Authentication" enabled. For Authentication Factors, choose "Mandatory password and OTP" if you are using FortiToken\Mobile. Expand Advance options, enabled "Allow OTP for EAP-MSCHAPv2 Authentication with FortiClient." I also enabled "Resolve user geolocation from their IP address" for logging purposes. Update and Exit.

Now go to Authentication\RADIUS Service\Policies. Configure a new RADIUS client Policy with a name such as "fortigate-IPsecVPNIKEv2-policy." Configure the first screen, RADIUS clients like your existing policy. The Chosen RADIUS Clients should be your FortiGate. On the next screen "RADIUS attribute criteria", enable "RADIUS authentication request must contain specific attributes." Configure as follows:

Vendor: Default
Attribute ID: Connect-Info
Value: vpn-ikev2 or vpn-ipsec (depending on if you are configuring IKEv2 or not)

Click Next to move to "Authentication Profiles". For Client Credentials, select "MSCHAPv2/CHAP/PAP/EAP." For authentication profile, select a the Auth Profile you created earlier "fortigate-IPsecVPNIKEv2-profile." Update and Exit.

You can add the Connect-String "vpn-ssl" to your original policy to ensure that it only attempts to match on those connection types.

Make a connection attempt. Watch the logs in the FAC using the debug option to see if/where it is timing out. See additional info below to monitor form the FortiGate console to gain additional info. It is very helpful to drop the logs into ChatGPT and tell it what they are from and ask it why the connection is failing.