Skip to main content
sbaltic
sbaltic
New Member
December 5, 2023
Question

Fortigate FG200 SSL VPN with Microsoft Entra Auth

  • December 5, 2023
  • 2 replies
  • 2289 views

Anyone manage to resolve this issue with OS 7.4.1 that can successfully authenticate SSL VPN user with Fortigate VPN SSL enterprise app on Entra ID?

I tried app from the library, own app, custom app but the error is always the same (session ended or incorrect HTTP request). 

I am using default 443 port ... and when I create SAML with gui I get ID like:
http://1.2.3.4:443/remote/saml/metadata/

https://1.2.3.4:443/remote/saml/login

https://1.2.3.4:443/remote/saml/logout

 

and cert from Entra is sha-256 not sha1 (witch is default encryption with new gui SAML)

 

Thx

2 replies

hbac
Staff
hbac
Staff
December 5, 2023

Hi @sbaltic,

 

Does SAML authentication work with only username and password? Since FortiGate is not responsible for authentications, it doesn't care which app you are using. FortiGate only waits for authentication results from IDP. 

 

You can try to increase remoteauthtimeout on the FortiGate to see if it helps: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Explaining-global-set-remoteauthtimeout-user/ta-p/229136

 

Regards, 

    sbaltic
    sbalticAuthor
    New Member
    December 8, 2023

    The problem is that I get "Session Ended" every time I login. So the fortigate login opens microsoft authentication and when I enter credentials I get "Session Ended"

    hbac
    Staff
    hbac
    Staff
    December 8, 2023

    @sbaltic, 

     

    Please double check your configuration and make sure the user group is specified in the firewall policy source. Please also make sure there is no group mismatch: -Followed below documents as error is matching:


    https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SAML-group-mismatch-issue-in-SSL-VPN/ta-p/193640
    https://community.fortinet.com/t5/FortiGate/Technical-Tip-Azure-SAML-group-mismatch-getting-error-remote/ta-p/204991

     

    Regards, 

    sbaltic
    sbalticAuthor
    New Member
    December 8, 2023

    Tried right now ... same problem. I don't see any group mismatch error. I think I tried everything. Even group ID and group name, always the same problem. Removed :443 also removed / (end of the matadata, login, logout) ... add enterprise app from scratch, add enterprise app FORTIGATE SSL VPN ... 

    Terms & ConditionsAccessibility statement