Technical Tip: Getting ERR_EMPTY_RESPONSE when connecting to IPSec SAML and users are inside the internal network

The possible reason for this problem is associated with a missing IPsec SAML server configuration on the inside(LAN) interface of the firewall. The ERR_EMPTY_RESPONSE seen on the browser indicates that the browser was unable to get any data back from the website or the response received is not what's expected.

In the case of remote users, the IPsec SAML may be configured either on the WAN link or on the loopback interface of the firewall; in that case SAML server should be configured only on these interfaces so that FortiGate can listen for the SAML authentication request from the FortiClient.

Example:

For Loopback : 

config system interface

    edit "Loopback"
        set ike-saml-server <saml-server-name>
    next

end

config system interface 

    edit "wan1"
        set ike-saml-server <saml-server-name>
    next

end

Check this article for configuring IPsec on the loopback interface Technical Tip: Implementing IPsec VPN SAML-based authentication using loopback Interface 

In the case of the LAN or WiFi users inside the firewall, the SAML server should be enabled on the LAN or WiFi interface.

config system interface
    edit <SSID or LAN interface name>
    set ike-saml-server <saml-server-name>
end

In short, all interfaces involved in the IPsec SAML configuration for IPsec negotiations must have the SAML server configured. In case the incoming interface is part of a software or hardware switch on the FortiGate, the SAML server should be configured on that switch interface.

Related articles:

Technical Tip: Configuring a dial-up IPsec VPN with Azure SAML authentication 

Troubleshooting Tip: Common problems and causes when using SAML with SSL VPN 

Technical Tip: Understanding the Browser's ERR_EMPTY_RESPONSE Error 

Troubleshooting Tip: Getting 'ERR_EMPTY_RESPONSE' when accessing FortiGate WAN interface for HTTPS management access after configuring IPsec VPN