Assistance Required – FortiAuthenticator SAML Integration with FortiGate IPsec VPN

Hi Cho, 

The SSO Login window shouldn't be looking like that... I guess there's something wrong with the settings on your FGT. 

First off, how's your FAC connected with your Gate? Is the FAC outside on your FortiGate's network ? 

1) Fortigate is using a default port for SAML Authentication (Port 1001, if im not mistaken).

Make sure this configured properly under the "config system global" settings. 

- Open SAML Service on the Firewall and set the port -

config system global
set auth-ike-saml-port 1001

2) In addition, you will have to spesify the "FAC" SSO option under the interface your FAC is conected to the Firewall. If the FAC is outside of your network you will need to configure it on your internet faced interface (WAN Port). 

- Make SAML accessible from the internet exposed interface OR THE INTERFACE YOU HAVE THE FAC CONNECTED -

config system interface
edit wan1 <--- Use WAN Port only if FAC if outside of our network, outherwise use the interface you have the FAC connected to.
set ike-saml-server "FAC" <--- "FAC" is the Single Sign-On Name value you configured. 
end

Hi @choee840408,

The SP's IP address needs to be <ipsec-vpn-gateway-fqdn/ip-address>:<saml-ike-authentication-port> as per document. In your case, as the SAML port is 1001, the SP IP address in the Single Sign On setting on both FGT and FAC should be 10.0.9.240:1001.

If this still doesn't work, please collect below debug log:

diagnose debug application ike -1

diagnose debug application samld -1

diagnose debug application fnbamd -1

diagnose vpn ike log filter rem-addr4 <client's public IP>

diagnose debug console timestamp enable

diagnose debug enable

Regards,

George

Dear All,
Thank you all for your help. The issue has been resolved. The cause was that the SP configuration on my FortiGate did not have the certificate enabled, which led to the connection failure. After enabling it, everything is working fine now. Thanks again!