New Member

Question

EMS-Managed FortiClient Sends EAP NAK on IKEv2 EAP-SAML IPsec VPN — Non-EMS Client Works

Forum|Forum|21 days ago
May 19, 2026
4 replies
125 views

ENVIRONMENT
FortiOS: 7.6.x (FortiGate 120G)
FortiClient EMS: 7.4.x (FortiCloud SaaS)
FortiClient: 7.4.7 (Windows)
Authentication: IKEv2 EAP-SAML via Microsoft Entra ID

---

ISSUE

FortiClient endpoints managed by EMS fail to complete IKEv2 IPsec VPN tunnel establishment after successful SAML authentication. The EMS-managed client sends an EAP NAK (type 08) in response to the FortiGate's EAP Identity Request, causing the FortiGate to tear down the IKE SA with 'unexpected payload type 41'.

A non-EMS-managed FortiClient with an identical manually-configured tunnel connects successfully every time. The failure is specific to EMS-managed clients.

---

FORTIGATE IKE DEBUG (EMS-MANAGED CLIENT)

The sequence on every EMS-managed connection attempt:

responder received AUTH msg
responder preparing EAP identity request
responder received EAP msg
unexpected payload type 41
schedule delete of IKE SA
connection expiring due to phase1 down

The client response decodes as EAP type 08 (EAP NAK) — the client is rejecting the EAP method offered by the FortiGate.

---

ROOT CAUSE IDENTIFIED

The EMS endpoint profile XML contains a mandatory <eap_method> field under vpn > ipsecvpn > connections > ike_settings. The EMS GUI exposes only two options for this field: MSCHAPv2 and TTLS. Neither is correct for IKEv2 EAP-SAML.

Attempting to set <eap_method> to 0 or remove the element entirely produces a validation error:

"vpn > ipsecvpn > connections > IAM UK > ike_settings > eap_method: invalid value 0"

The non-EMS client works because it has no <eap_method> constraint and negotiates the EAP method freely.

EMS does not expose EAP-SAML as a valid <eap_method> option, making it impossible to push a working IKEv2 EAP-SAML IPsec VPN configuration via an EMS endpoint profile.

---

TROUBLESHOOTING PERFORMED

- Confirmed authusrgrp set correctly on FortiGate phase1 (VPN_Users group with SAML server member)
- Tested all available <eap_method> values via EMS GUI (MSCHAPv2, TTLS) — EAP NAK on both
- Attempted to remove <eap_method> element entirely via XML edit — validation error, EMS rejects
- Attempted <eap_method>0</eap_method> — validation error
- Disabled certificate auth settings in EMS XML (usewincert, use_win_current_user_cert etc.) — no impact
- Tested use_gui_saml_auth 0 and 1 — no impact
- Confirmed ems-sn-check disabled on FortiGate phase1
- Confirmed azure-ad-autoconnect disabled on FortiGate phase1
- Confirmed EMS connector healthy: WebSocket connected, API calls succeeding
- Confirmed endpoint has valid online ec-shm record
- Confirmed firewall policy has no ZTNA tag or posture enforcement
- eap-exclude-peergrp not available on FortiOS 7.6.x

---

QUESTIONS

1. Is there a supported <eap_method> value for EAP-SAML in FortiClient EMS 7.4.x endpoint profiles?
2. Is this a known limitation or defect in EMS 7.4.x?
3. Is there any workaround to push a working IKEv2 EAP-SAML IPsec VPN tunnel via EMS without the <eap_method> constraint blocking negotiation?

Happy to share full IKE debug output and EMS profile XML if helpful.

alejandro404

New Member

As far as i know there is not such thing as EAP-SAML, SAML indeed is not an EAP method but Fortigate still requires for IKEv2 VPN dial up, after SAML user is authenticated Fortigate caches user authentication and during vpn negotiation validate the user against this, you can check more detailed explanation about this here:

Not aware of any known limitation or defect on EMS 7.4, have deployed a couple of it with vpn ikev2 using saml with no big issues.
EAP-MSCHAPv2 is the default and usually works fine with saml (at least on the cases that i tested).
Can you run the eap_proxy debug to see if you can grab more information about it, if it is something related to EAP it could help.
diagnose debug application eap_proxy -1

P

pd_ukAuthor

New Member

Hello!

Thanks for the reply and sorry for the delayed response.

No output from the debug command, I am afraid.

vpolovnikov

Staff & Editor

I’m wondering if pre-shared key matches on both sides… Ref Troubleshooting Tip: IKEv2: unexpected payload type 41 | Community

P

pd_ukAuthor

New Member

The PSK is correct as it uses the same XML file for non-EMS deployed clients (which work fine).

P

pd_ukAuthor

New Member

Here is the log from the EMS console:

2026-06-02 15:37:51

2

VPN connection: Disconnected from VPN tunnel "IAM UK", SA_Negotiate_Generic_Error

P

pd_ukAuthor

New Member

UPDATE — ROOT CAUSE IDENTIFIED

Posting an update for anyone who hits this issue.

After extensive debugging, the root cause has been identified through comparative IKE debug analysis between a working non-EMS client and failing EMS-managed clients.

---

FINDING

The FortiGate EAP handling forks based on whether the connecting FortiClient includes an EMS serial number (EMSSN) in its IKE FCT vendor data.

Working non-EMS client FCT data:
EMSID=
(EMSSN field absent entirely)

Failing EMS-managed client FCT data:
EMSID=00000000000000000000000000000000
EMSSN=FCTEMS8826004109

When EMSSN is absent, the FortiGate correctly routes EAP through its internal EAP_PROXY (127.0.0.1:1812) → FNBAM → SAML backend:

send EAP message to FNBAM
initiating EAP authentication
FNBAM_CHALLENGED → FNBAM_SUCCESS
authentication succeeded
tunnel up

When EMSSN is present, the FortiGate takes a different EAP handling path that does not support EAP-SAML:

responder received EAP msg
unexpected payload type 41
schedule delete of IKE SA

The EMS-managed client is never sending a true EAP NAK — the FortiGate is mishandling the EAP message entirely because the presence of EMSSN triggers a code path that does not invoke EAP_PROXY.

---

CONTRIBUTING FACTOR

FortiClient EMS 7.4.x does not expose EAP-SAML as a valid <eap_method> in endpoint profiles. The field is mandatory and only accepts MSCHAPv2 or TTLS via the GUI. Setting the value to 0 or removing the element produces a validation error:

"vpn > ipsecvpn > connections > [tunnel] > ike_settings > eap_method: invalid value 0"

This means even if the FortiOS EAP handling issue is resolved, the EMS profile cannot currently be configured to use EAP-SAML through normal means.

---

ENVIRONMENT
FortiOS: 7.6.x (FortiGate 120G)
FortiClient EMS: 7.4.x (FortiCloud SaaS)
FortiClient: 7.4.7 (Windows)
Authentication: IKEv2 EAP-SAML via Microsoft Entra ID

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded