Technical Tip: How to configure Microsoft Entra ID SAML authentication for dial-up IPsec VPN
Description
This article describes how to configure a dial-up IPsec VPN with Microsoft Entra ID SAML authentication.
Scope
FortiGate and FortiClient v7.2.4 or later.
Solution
FortiClient v7.2.4 or later supports SAML with Dial-up IPsec VPN only with IKEv2. SAML is not supported with IKEv1.
The steps below show how to create a Dial-up IPsec VPN with Microsoft Entra ID (formerly known as Azure AD) SAML.
Configure the auth-ike-saml-port in the FortiGate as shown below:
config system global
set auth-ike-saml-port 9443
end
The default TCP port for IKE SAML is 1001.
In FortiOS v7.6.1 and later, the SAML service also listens on the ike-tcp-port. Note that auth-ike-saml-port and ike-tcp-port should not overlap. See Technical Tip: Using the same TCP port for IPsec SAML authentication and IKE TCP encapsulation in FortiOS v7.6.1.
Changing this setting flushes existing IPsec tunnels:
config system setting
set ike-tcp-port 9443
end
Configure the VPN certificate under user settings:
config user setting
set auth-cert "Fortinet_Factory"
end
In the GUI, navigate to User & Authentication -> Authentication Settings:
In the GUI, navigate to User & Authentication -> Single Sign-on, and select 'Create new'. Configure SAML on the FortiGate and use the custom ike-saml-port in the address field:
Create an Enterprise application in Microsoft Entra ID. Follow the guide below to create this enterprise application: Technical Tip: Configuring SAML SSO login for FortiGate administrators with Entra ID acting as SAML IdP.
The Service provider configuration from Step 3 should be populated in the SAML Application in Azure, as shown in the screenshots below:
Identity provider configuration from Azure should be populated in the SAML configuration on the FortiGate, as shown below:
IDP configuration from Azure Entra-ID:
FortiGate Identity Provider configuration:
Note:
The Azure links for 'Assertion consumer service URL' and 'single logout service URL' are likely to be the same, but it has to be confirmed.
Inside Attributes & Claims, perform the following steps:
Add a New claim, with Name set to 'username' and Source Attribute set to 'user.userprincipalname'.
Edit the existing Group claim. Choose 'Groups assigned to the Application'. Under Advanced options -> Customize the name of the group claim, add the name as 'group' without quotes.
The Attributes and Claim configuration needs to be like the ones in the following image:
Match the attributes on the FortiGate:
Certificate configuration:
Download the Certificate (Base64) and import it into the FortiGate as a Remote Certificate. See Remote certificate.
It is possible to rename this certificate in the CLI using the 'rename' command to make it easier to identify.
For example:
config vpn certificate remote
rename REMOTE_Cert_1 to 'CERT_VPN_IPSEC_SAML'
end
Signing Option: Select SAML response and assertion (Default: Sign SAML assertion).
Starting from v7.2.12, v7.4.9, and v7.6.4, FortiGate verifies the signature of SAML Response messages in addition to SAML assertions. See Troubleshooting Tip: SAML Authentication fails after firmware upgrade to v7.2.12, v7.4.9 or v7.6.4.
Update: As per change #1196434, the following FortiOS versions add a CLI option that allows administrators to control signature verification for SAML responses and assertions: v8.0.0 (ETA Mar. 2026), v7.6.5, v7.4.10, v7.2.14, v7.0.18, and all later versions.
The new CLI option is displayed below and allows administrators to select between requiring both the response and the assertion to be signed (enable, set by default) or requiring that at least one of the two is signed (disable). More information can be found in the FortiOS Release Notes.
Continuing the configuration:
config user saml
edit <name>
set require-signed-resp-and-asrt <enable | disable>
next
end
enable: Both response and assertion must be signed and valid.
disable: At least one of the responses or assertions must be signed and valid (default).
Signing Algorithm: Algorithm used by Microsoft Entra-ID for signing SAML Assertion and Response.
Entra-ID Default: SHA-256.
9. SAML configuration on the FortiGate should look like this, where:
'CERT_VPN_IPSEC_SAML' is the IDP certificate.
'set digest-method sha1' is the default algorithm used by FortiGate for signing SAML Request. Does not need to match the signing algorithm in Entra.
config user saml
edit "entra-id-saml"
set cert "Fortinet_Factory"
set entity-id http://10.21.7.128:9443/remote/saml/metadata/
set single-sign-on-url https://10.21.7.128:9443/remote/saml/login
set single-logout-url https://10.21.7.128:9443/remote/saml/logout
set idp-entity-id https://sts.windows.net/adb5b7eb-755e-48ae-a166-c296d5c7fe37/
set idp-single-sign-on-url https://login.microsoftonline.com/adb5b7eb-755e-48ae-a166-c296d5c7fe37/saml2
set idp-single-logout-url https://login.microsoftonline.com/adb5b7eb-755e-48ae-a166-c296d5c7fe37/saml2
set idp-cert "CERT_VPN_IPSEC_SAML"
set user-name "username"
set group-name "group"
set digest-method sha1
next
end
Group configuration for IPsec VPN:
Add Groups under 'Users and Groups' in the Enterprise App on Entra-ID that can connect to the VPN.
Note down the Group's Object ID:
Configure the user group on FortiGate with the SAML server name (entra-id-saml) and map the Group ID of the IPsec VPN user group from Entra-ID. In this example, '8b331191-cb6b-4a6d-a8f2-35415ab7e7aa' is the object ID of the group in Entra-ID:
config user group
edit "ike-saml"
set member "entra-id-saml"
config match
edit 1
set server-name "entra-id-saml"
set group-name "8b331191-cb6b-4a6d-a8f2-35415ab7e7aa"
next
end
next
end
Configure ike-saml-server under the listening interface:
config system interface
edit "port2"
set ike-saml-server "entra-id-saml"
next
end
The ike-saml-server setting enables a configured SAML server to listen on a FortiGate interface for SAML authentication requests from FortiClient remote access IPsec VPN clients.
Currently, this setting can only be configured in the CLI as follows. Replace <interface name> with the WAN interface name.
config system interface
edit <interface name>
set ike-saml-server <saml_server name>
next
end
Configure dial-up IPsec VPN. Here, 'ike-sam1' is the SAML user group.
config vpn ipsec phase1-interface
edit "saml-vpn"
set type dynamic
set interface "port2"
set ike-version 2
set peertype any
set net-device disable
set mode-cfg enable
set proposal des-sha1 des-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256
set dpd on-idle
set eap enable
set eap-identity send-request
set authusrgrp "ike-saml"
set ipv4-start-ip 10.1.1.1
set ipv4-end-ip 10.1.1.254
set dns-mode auto
set psksecret ENC <psk>
set dpd-retryinterval 60
next
end
Starting from version 7.6.1, EAP options and the authusrgrp parameter are also available in the GUI.
config vpn ipsec phase2-interface
edit "saml-vpn"
set phase1name "saml-vpn"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
next
end
Note:
In FortiOS v7.4 and earlier, the 'eap' and 'authusrgrp' settings highlighted above under Phase1 configuration are only available through the CLI. They are also available in the GUI as of FortiOS v7.6.
To use multiple groups with an IPsec dial-up tunnel, configure 'set authusrgrp ""' and use the SAML Group under the source section of Firewall Policies as described in Technical Tip: How to use multiple groups with EAP for IKEv2 (SAML/RADIUS/local).
Configure firewall policy:
config firewall policy
edit 0
set name "saml-vpn"
set srcintf "saml-vpn"
set dstintf "port2"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set nat enable
next
end
Note: Configure the user group either in the firewall policy or in the Phase 1 VPN settings (authusrgrp), but not both.
Configure the remote authentication timeout value as needed:
config system global
set remoteauthtimeout 120
end
On the user machine, configure IPsec VPN with SSO for VPN tunnel enabled and customize the port as set in step 1.
Note:
Remote Gateway must be an FQDN or IP address only and should not include the SAML port or '/remote/saml/login'.
If an untrusted certificate is used in step 2, FortiClient will show this warning:
Users can now successfully log in using Entra ID SAML to the Dial-up IPsec VPN.
Note:
Enabling IPsec with SAML from an internal network, like the LAN or the Wi-Fi SSID, is also possible. Make sure to set the SAML server on that port so it enables SAML request listening on that specific port.
config system interface
edit <SSID or LAN interface name>
set ike-saml-server <saml server name>
end
Notes:
IKE with SAML authentication does not currently support multiple SAML servers on the same interface, as the SAML server is directly bound to the interface and allows only one instance to be configured.
Keep this in mind when migrating from SSL VPN to IPsec VPN. Validate the SAML server object associated with this interface to ensure it is not the one associated with the SSL VPN tunnel; only one is allowed, and it must match the SAML ENTRA-SSO object configured in the interface for dial-up IPsec tunnel, which should not be associated with SSL VPN SAML.
Using a similar port number on auth-ike-saml-port and on VIP/IP pool may cause issues even if the extip is different on the interface where the SAML is configured. The workaround is to change the port number to a different value on either the VIP or the auth-ike-saml-port. This behavior is resolved in v7.4.10, v7.6.5, v8.0.0, and later: Changes in default behavior (v7.4.10).
FortiClient macOS support for IKEv2 requires v7.4.3 for the free client: Technical Tip: FortiClient Mac (macOS) IPsec VPN IKEv2 support.
Troubleshooting:
Execute the following commands to enable debugging on the FortiGate, then reproduce the issue if there is one:
diagnose debug console timestamp enable
diagnose debug application fnbamd -1
diagnose debug application samld -1
diagnose debug application ike -1
diagnose debug application eap_proxy -1
diagnose debug enable
To stop the debugging, run the following commands:
diagnose debug disable
diagnose debug reset
Example output of debugging:
Username and group will be sent once authentication completes:
samld_send_common_reply [99]: Attr: 17, 31, magic=0005078391918893
samld_send_common_reply [99]: Attr: 18, 33, 2025-10-03T07:33:00.084Z
samld_send_common_reply [95]: Attr: 10, 99, 'http://schemas.microsoft.com/identity/claims/tenantid' '267a0bd3-27c7-43b6-91cc-2b7b3566d206'
samld_send_common_reply [95]: Attr: 10, 107, 'http://schemas.microsoft.com/identity/claims/objectidentifier' '7edcc834-0b48-407f-a149-0c430dff9a63'
samld_send_common_reply [95]: Attr: 10, 72, 'http://schemas.microsoft.com/identity/claims/displayname' 'User 1'
samld_send_common_reply [95]: Attr: 10, 132, 'http://schemas.microsoft.com/identity/claims/identityprovider' 'https://sts.windows.net/267a0bd3-27c7-43b6-91cc-2b7b3566d206/'
samld_send_common_reply [95]: Attr: 10, 146, 'http://schemas.microsoft.com/claims/authnmethodsreferences' 'http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password'
samld_send_common_reply [95]: Attr: 10, 78, 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname' 'User1'
samld_send_common_reply [95]: Attr: 10, 75, 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname' 'Test'
samld_send_common_reply [95]: Attr: 10, 96, 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name' 'user1@csn339.onmicrosoft.com'
samld_send_common_reply [95]: Attr: 10, 46, 'username' 'user1@csn339.onmicrosoft.com' <----- User account
samld_send_common_reply [95]: Attr: 10, 52, 'group' '8b331191-cb6b-4a6d-a8f2-35415ab7e7aa' <----- The group in this example is the object ID of the user group.
samld_send_common_reply [99]: Attr: 11, 1097, https://login.microsoftonline.com/......
samld_send_common_reply [119]: Sent resp: 15040, pid=2055, job_id=563593.
ike V=root:0: comes 124.120.105.176:500->10.47.1.243:500,ifindex=3,vrf=0,len=466.... <----- After SAML authentication is completed, the client will send packets to establish the IPsec tunnel. Therefore, the IKE debug will be triggered after SAML authentication.
For detailed troubleshooting steps, refer to Technical Tip: Troubleshoot IPsec SAML Dial-Up tunnel.
Notes:
Dial-up IPsec with SAML using an external browser for authentication is supported starting from FortiOS v7.4.9 and v7.6.1, FortiClient v7.2.5 and v7.4.1 for Mac and Windows, and FortiClient v7.4.3 for Linux: Technical Tip: FortiClient SAML Authentication Configuration Demystified.
Starting from FortiGate v7.2.12, v7.4.9, and v7.6.4, the device verifies the signature of SAML response messages. This enhancement is detailed in the SAML certificate verification section of the Release Notes: SAML certificate verification.
This enhancement also applies to FIPS-CC CVE-Patched builds for FortiOS v7.2 (for example, builds beginning with FIPS-CC-72-5 and later).
FIPS-CC related documents:
For detailed troubleshooting steps and configuration guidance, refer to Troubleshooting Tip: SAML Authentication fails after firmware upgrade to v7.2.12, v7.4.9 or v7.6.4.
Related documents:
Troubleshooting Tip: SAML Authentication fails after firmware upgrade to v7.2.12, v7.4.9 or v7.6.4.
Technical Tip: How to use multiple groups with EAP for IKEv2 (SAML/RADIUS/local)
Configuring SAML SSO login for SSL VPN with Entra ID acting as SAML IdP
SAML-based authentication for FortiClient remote access dialup IPsec VPN clients