What is eXtended Authentication (XAuth)?

eXtended Authentication (XAuth) is an extension to the IKEv1 protocol used in IPsec VPNs. Its primary function is to add a second layer of authentication specifically for the remote user, which occurs after the initial IKE Phase 1 peer authentication (using a pre-shared key or digital certificate) has been successfully completed. The VPN gateway challenges the remote client to provide user-specific credentials, typically a username and password. This allows for individual user identification and authorization, which is essential in remote access scenarios where multiple users might use the same VPN client configuration.

A. "Local ID" refers to an identifier for the VPN peer itself during IKE negotiation, not the user-specific credential mechanism that XAuth provides.
C. A pre-shared key is a primary IKE Phase 1 authentication method for VPN peers, which XAuth is designed to supplement, not perform.
D. Digital certificates are a primary IKE Phase 1 authentication method for VPN peers, which XAuth is designed to supplement, not perform.

1. Fortinet FortiOS 7.0.0 VPN Administration Guide:

In the section "Dialup user IPsec VPN with XAuth

" it states

"Extended Authentication (XAuth) can be used to prompt remote dialup users for a user name and password in addition to the standard IKE authentication (preshared key or certificate)." (Page 110)

2. IETF Internet-Draft

draft-ietf-ipsec-isakmp-xauth-06.txt:

Section 1

Introduction: "XAuth provides a method for authenticating a user after an IKE phase 1 exchange has completed. This is accomplished by sending user name and password information over the IKE SA." This foundational document explicitly defines XAuth's purpose as user authentication via username and password.