For user authentication in dialup IPsec, IKEv1 uses XAuth (Extended Authentication) after Phase 1 for username/password. IKEv2 uses EAP (Extensible Authentication Protocol) for similar user auth. Phase 1 and SA_INIT are for peer auth, Phase 2 for child SA negotiation. Exact extract: XAuth increases security by requiring remote dialup client users to authenticate in a separate exchange at the end of phase 1. IPsec IKEv2 VPNs now support certificate authentication and EAP authentication at the same time from a dialup FortiClient. With the eap-cert-auth setting ... IPsec IKEv2 VPNs now support certificate authentication and EAP authentication at the same time from a dialup FortiClient. IPsec IKEv1 uses XAUTH for user authentication, and IPsec IKEv2 uses EAP for user authentication. Only EAP-TTLS is interoperable with LDAP. For LDAP based user ... In your scenario, the user cannot authenticate by providing both a PSK and their credentials (using one of multiple EAP methods).