IPSEC VPN IKEv2 with EntraID  Authentication

Prepare configuration on Azure side using instructions under the link: https://docs.fortinet.com/document/fortigate/8.0.0/administration-guide/432396/configuring-microsoft-entra-id-as-saml-idp-and-fortigate-as-saml-sp

on FortiGate: 

To export SAML IdP server certificate and import it on FortiGate: 

1- On FortiGate, go to System > Certificates, and from the Create/Import dropdown, select Remote Certificate. 

2- Select Upload to locate and upload the .cer remote certificate from your computer. 

3- Click OK. The certificate will now be visible under System > Certificates > Remote Certificate. 

Config SAML Auth on FortiGate: 

1- Configure the auth-ike-saml-port in the FortiGate:  

Config  system  global  
    set auth-ike-saml-port ≤port_number>  
end  

————————— 

2- Configure the VPN certificate under user settings: 

Config  user  setting  
    set auth-cert <ssl_vpn_cert_name>  
end

———————— 

3- Configure SAML on the FortiGate and use the custom ike-saml-port in the address field:  

Config  user  saml  
    edit user_name  
        set cert <ssl_vpn_cert_name>  
        set entity-id  http://fqdn:port/remote/saml/metadata/  
        set single-sign-on-url  https://fqdn:port/remote/saml/login  
        set single-logout-url  https://fqdn:port/remote/saml/logout  
        set idp-entity-id  https://sts.windows.net/**************  
        set idp-single-sign-on-url  https://login.microsoftonline.com/*************************/saml2  
        set idp-single-logout-url  https://login.microsoftonline.com/*********************+/saml2  
        set idp-cert REMOTE_Cert_x (cert imported from Azure application)  
        set user-name "username (must match claim in Azure application)“  
        set group-name "group (must match claim in Azure application)"  
        set digest-method sha1  
    next  
end  

————————— 

4- Configure ike-saml-server under the listening interface:  

Config  system  interface  
    edit port1  
        set ike-saml-server  (name created in step 3) 
    next  
end  

———————— 

5- Configure user group with the SAML server:  

Config  user  group  
    edit group_name  
        set member <username created in step 3>  
    next  
end  

———————— 

6- Configure Dial-up IPsec VPN IKEv2 in GUI 

THEN: 

 edit eap in CLI:  

Config  vpn  ipsec  phase1-interface  
 edit ≤name>  
Set  eap  enable  
        set  eap-identity send-request  
        set  authusrgrp (group  created  in  step 5)  
end

———————— 

7- firewall policy: 

Without a firewall policy including the SAML user/Group no IPSEC connection will be established at all, forticlient will fail to connect 

———————— 

Configure FortiClient: 

VPN: IPsec VPN 

Remote Gateway: public IP on your WAN interface OR FQDN, depending on what you configured in the enterprise application in Azure and the Certificate (auth-cert in step 2)  Authentication Method: Preshared Key or Certificate  Enable Single Sign On for VPN Tunnel  Specify the port we selected earlier (step 1)  Expand Advanced Settings > VPN Settings  IKE: Version 2  Options: Mode Config  After adding the new VPN configuration, click Connect and you’ll be prompted to login to your IdP and will be connected.