Staff

Technical Tip: SAML IDP redirect failures on Remote IPsec VPN connections

Forum|Forum|1 year ago
June 4, 2025
0 replies
1567 views

Description

This article describes an issue where users connecting to the IPsec remote VPN are not redirected to the SAML IDP for authentication.

Scope

FortiGate.

Solution

When the user is trying to connect to the IPsec remote VPN, the IDP login page is not loading.

This issue can occur when the ike-saml-server is not configured on the interface on which the IPsec VPN is configured to listen.

Configure the ike-saml-server under the concerned interface. Enable the ike-saml-server under the interface using this command:

config system interface
    edit <name>
        set ike-saml-server <saml_server>
    next
end

Note: ike-saml-server can only be configured using CLI.

The error could also occur if the ports being used on SAML Service Provider URL is different than what is set on auth-ike-saml-port under global config. Ensure they are the same :

config system global
    set auth-ike-saml-port 9443 
end

config user saml
    edit "SAML"
        set entity-id "http://example.com:9443/remote/saml/metadata/"
        set single-sign-on-url "https://example.com:9443/remote/saml/login"
        set single-logout-url "https://example.com:9443/remote/saml/logout"
...
end

Once the ike-saml-server is enabled on an interface, the FortiGate will start to listen for SAML authentication requests from FortiClient remote access IPsec VPN clients.

This issue can also occur if the SAML redirection uses a public FQDN, but the client/browser cannot resolve it to the right public IP, and the page fails. Ensure that the client is able to resolve the public FQDN.

Debugs to be taken if any issue occurs:

diagnose debug application ike -1
diagnose debug application samld -1
diagnose debug application fnbamd -1
diagnose debug application eap_proxy -1
diagnose debug console timestamp enable
diagnose debug enable

To disable: