Troubleshooting Tip: IPsec SAML VPN connection failure when accessing from FortiGate LAN interfaces

Sometimes, when users are connected to a LAN interface on the FortiGate and IPsec VPN uses SAML authentication configured on the WAN interface, VPN connection fails during the SAML authentication redirect phase. The SAML login page will not load.

Root cause:

For IPsec VPNs using SAML authentication, the SAML server must be accessible via the same interface that handles the user’s web (browser) traffic during the authentication process.
If the SAML server is only configured on the WAN interface, users originating from a LAN interface will not be able to complete SAML authentication.

Solution:

Configure the SAML server on the LAN interface from which users initiate the VPN connection.

config system interface
    edit "Interface-name"
        set ike-saml-server <saml server name>
end

Repeat this configuration for any LAN interface from which users are expected to connect to the IPsec VPN using SAML authentication.

Technical Tip: How to configure Microsoft Entra ID SAML authentication for dial-up IPsec VPN

Technical Tip: FortiGate IPsec VPN configuration with Google SAML

SAML-based authentication for FortiClient remote access dialup IPsec VPN clients | FortiOS Administration Guide