Technical Tip: Configuring IPsec VPN IKEv2 with DUO SAML

Description

This article describes how to configure a dial-up IKEv2 IPsec VPN using Duo Single Sign-On as the SAML identity provider.

Scope

FortiOS v7.6.3 or later, FortiClient v7.2.4 or later, Cisco DUO.

Solution

Configure the Duo SAML application, FortiGate SAML service provider, IKEv2 tunnel, group mapping, and FortiClient profile.

1. Configuring Cisco Duo:
   

• In the Duo Admin Panel, add the Fortinet FortiGate application from Applications -> Application Catalog.

• Grant access to the required users or groups.

• Download the Duo SAML signing certificate.

• Enable Sign response and Sign assertion.

• Keep the application open for the IdP Entity ID, SSO URL, SLO URL, and service-provider mapping.

Note:
Use Username as the user attribute and groups as the group attribute. Both are case-sensitive.

2. Configuring FortiGate:

Import the Duo certificate:
Go to System -> Certificates -> Create/Import -> Remote Certificate and import the Duo signing certificate.

Configure the SAML port and certificate:

config system global 
    set auth-ike-saml-port 9443
end

config user setting 
    set auth-cert <SAML_Certificate>
end

Create the SAML Server:
GUI:

• Go to User & Authentication -> Single Sign-On -> Create New.

• Set the integration name to 'Duo-IPsec-SAML'.

• Set the service-provider address to an FQDN that resolves to the external interface hosting the VPN. Include the 'auth-ike-saml-port' after the domain, for example 'vpn.example.com:9443'.

• Enter the Duo IdP Entity ID, SSO URL, SLO URL, and remote certificate.

• Set the user attribute to 'Username' and group attribute to 'groups'.

• Save, reopen the object, and copy the generated FortiGate SP Entity ID and ACS URL into the Duo application.

CLI sample:

config user saml
    edit "Duo-IPsec-SAML"
        set entity-id "http://vpn.example.com:9443/remote/saml/metadata/"
        set single-sign-on-url "https://vpn.example.com:9443/remote/saml/login"
        set single-logout-url "https://vpn.example.com:9443/remote/saml/logout"
        set idp-entity-id "https://sso-aaaabbbb.sso.duosecurity.com/saml2/sp/AAAAABBBBB12345CCCCC/metadata"
        set idp-single-sign-on-url "https://sso-aaaabbbb.sso.duosecurity.com/saml2/sp/AAAAABBBBB12345CCCCC/sso"
        set idp-single-logout-url "https://sso-aaaabbbb.sso.duosecurity.com/saml2/sp/AAAAABBBBB12345CCCCC/slo"
        set idp-cert <DUO SAML signing certificate>
        set user-name "Username"
        set group-name "groups"
        set digest-method sha1
    next
end

Map SAML to the incoming interface:

config system interface 
    edit <WAN_Interface> 
        set ike-saml-server "Duo-IPsec-SAML" 
    next
end

Create the FortiGate group and complete Duo mapping:

config user group 
    edit "Duo-IPsec-Users" 
        set member "Duo-IPsec-SAML"
            config match
                edit 1
                    set server-name "Duo-IPsec-SAML"
                    set group-name "Site A VPN users"
                next
            end
        next
    end

In Duo, map the permitted Duo group to the group name 'Site A VPN users', then save the application.

Configure the IKEv2 dial-up tunnel:

IPsec Tunnel:

config vpn ipsec phase1-interface 
   edit "Duo-IPsec" 
      set type dynamic 
      set interface <WAN_Interface> 
      set ike-version 2 
      set peertype any 
      set net-device disable 
      set mode-cfg enable 
      set proposal aes256-sha256 aes128-sha256 
      set dhgrp 14 
      set eap enable 
      set eap-identity send-request 
      set ipv4-start-ip 10.20.30.10 
      set ipv4-end-ip 10.20.30.200 
      set ipv4-netmask 255.255.255.0 
      set psksecret <pre-shared-key> 
   next
end

config vpn ipsec phase2-interface
   edit "Duo-IPsec-P2" 
      set phase1name "Duo-IPsec" 
      set proposal aes256-sha256 aes128-sha256 
      set dhgrp 14 
   next
end

Firewall policy:

config firewall policy 
   edit 0 
      set name "Duo-IPsec-to-LAN" 
      set srcintf "Duo-IPsec" 
      set dstintf <LAN_Interface>
      set action accept 
      set srcaddr "all" 
      set dstaddr "LAN_Subnet" 
      set schedule "always" 
      set service "ALL" 
      set groups "Duo-IPsec-Users" 
      set nat disable 
   next
end

Note:
This example applies the SAML group in the firewall policy.
When configuring a SAML group on a VPN firewall policy, do not configure any group (even the same group) under authusrgrp in 'config vpn ipsec phase1-interface', because it causes a conflict. See Technical Tip: How to use multiple groups with EAP for IKEv2 (SAML/RADIUS/local).

Configure FortiClient:

• Create an IPsec VPN profile with remote gateway 'vpn.example.com' and the same pre-shared key used on FortiGate.

• Enable Single Sign On for VPN Tunnel and enter the SAML port.

• Use IKEv2 and Mode Config. Phase 1 and Phase 2 proposals must match FortiGate.

• Use the supported external-browser option if the embedded browser returns HTTP 403, or the selected Duo authentication method requires it.

Verify and troubleshoot:
Connect from an external network. Confirm that Duo authentication completes, the tunnel is established, and the client receives an address from the configured mode-config range.

Debug commands:

diagnose debug reset
diagnose debug console timestamp enable
diagnose debug application samld -1
diagnose debug application fnbamd -1
diagnose debug application eap_proxy -1
diagnose vpn ike log filter rem-addr4 <REMOTE_HOST_PUBLIC_IP>
diagnose debug application ike -1
diagnose debug enable

Stop the debug after reproducing the issue:

diagnose debug disable
diagnose debug reset

Note:
All IPsec parameters shown are samples. Update all fields with valid production values before applying the configuration.

Related documents:

SAML-based authentication for FortiClient remote access dial-up IPsec VPN clients

Duo Single Sign-On for Fortinet FortiGate VPN IPsec and FortiClient