IPSEC VPN IKEv2 with EntraID  Authentication

Prepare configuration on Azure side using instructions under the link: https://docs.fortinet.com/document/fortigate/8.0.0/administration-guide/432396/configuring-microsoft-entra-id-as-saml-idp-and-fortigate-as-saml-sp

on FortiGate: 

To export SAML IdP server certificate and import it on FortiGate: 

1- On FortiGate, go to System > Certificates, and from the Create/Import dropdown, select Remote Certificate. 

2- Select Upload to locate and upload the .cer remote certificate from your computer. 

3- Click OK. The certificate will now be visible under System > Certificates > Remote Certificate. 

 

Config SAML Auth on FortiGate: 

1- Configure the auth-ike-saml-port in the FortiGate:  

Config  system  global      set auth-ike-saml-port ≤port_number>  end 

————————— 

2- Configure the VPN certificate under user settings: 

Config  user  setting      set auth-cert <ssl_vpn_cert_name>  end 

———————— 

3- Configure SAML on the FortiGate and use the custom ike-saml-port in the address field:  

Config  user  saml      edit user_name          set cert <ssl_vpn_cert_name>          set entity-id  http://fqdn:port/remote/saml/metadata/          set single-sign-on-url  https://fqdn:port/remote/saml/login          set single-logout-url  https://fqdn:port/remote/saml/logout          set idp-entity-id  https://sts.windows.net/**************          set idp-single-sign-on-url  https://login.microsoftonline.com/*************************/saml2          set idp-single-logout-url  https://login.microsoftonline.com/*********************+/saml2          set idp-cert REMOTE_Cert_x (cert imported from Azure application)          set user-name "username (must match claim in Azure application)“          set group-name "group (must match claim in Azure application)"          set digest-method sha1      next  end 

————————— 

4- Configure ike-saml-server under the listening interface:  

Config  system  interface      edit port1          set ike-saml-server  (name created in step 3)     next  end 

———————— 

5- Configure user group with the SAML server:  

Config  user  group      edit group_name          set member <username created in step 3>      next  end 

———————— 

6- Configure Dial-up IPsec VPN IKEv2 in GUI 

THEN: 

 edit eap in CLI:  

Config  vpn  ipsec  phase1-interface   edit ≤name>  Set  eap  enable          set  eap-identity send-request          set  authusrgrp (group  created  in  step 5) 

———————— 

7- firewall policy: 

Without a firewall policy including the SAML user/Group no IPSEC connection will be established at all, forticlient will fail to connect 

———————— 

Configure FortiClient: 

VPN: IPsec VPN 

Remote Gateway: public IP on your WAN interface OR FQDN, depending on what you configured in the enterprise application in Azure and the Certificate (auth-cert in step 2)  Authentication Method: Preshared Key or Certificate  Enable Single Sign On for VPN Tunnel  Specify the port we selected earlier (step 1)  Expand Advanced Settings > VPN Settings  IKE: Version 2  Options: Mode Config  After adding the new VPN configuration, click Connect and you’ll be prompted to login to your IdP and will be connected.