Skip to main content
LVHan
LVHan
New Member
October 10, 2025
Question

How to user grouping on Forticlient IPSec VPN with Azure Entra ID

  • October 10, 2025
  • 6 replies
  • 1936 views

I really run out of idea on user grouping based on Azure Entra ID object ID.

I Follow the administration guide to prepare SSL VPN migrate to IPSec VPN with SAML

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/951346/saml-based-authentication-for-forticlient-remote-access-dialup-ipsec-vpn-clients#SAMLIdP

 

On phase 1 configuration I face EAP credential error 

config vpn ipsec phase1-interface     edit "FCT_SAML"         set eap enable         set eap-identity send-request     next end

Look for lots of tech doc only this work
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Error-EAP-failure-with-IPsec-Dial-Up-VPN-using/ta-p/363196

 

Which mean I had to define the user Group without any Entra Object ID to make user authenticate success or firewall policy with the user group without Entra ID object.

config vpn ipsec phase1-interface
edit IPSec123
set authusrgrp "Azure_IPsec_Empty"
next
end


config user group
edit "Azure_IPsec_Empty"
set member "Azure_IPsec"
next
end


So no issue getting user connect with FortiClient IPSec

diagnose vpn ike gateway list

vd: root/0
name: IPSec123_0
version: 2
interface: port99 
addr: 192.168.20.1:4500 -> 8.8.8.8:14664
tun_id: 10.99.99.1/::10.0.0.4
remote_location: 0.0.0.0
network-id: 0
transport: UDP
virtual-interface-addr: 169.254.1.1 -> 169.254.1.1
created: 39628s ago
eap-user: test@limvuihan.com
2FA: no
peer-id: Testing123
peer-id-auth: yes
FortiClient UID:
assigned IPv4 address: 10.99.99.1/255.255.255.255
nat: me peer
pending-queue: 0
PPK: no
IKE SA: created 1/1 established 1/1 time 180/180/180 ms
IPsec SA: created 1/1 established 1/1 time 0/0/0 ms

id/spi: 148531
direction: responder
status: established 39628-39627s ago = 180ms
proposal: aes256-sha256
child: no
SK_ei:
SK_er:
SK_ai:
SK_ar:
PPK: no
message-id sent/recv: 0/53
QKD: no
lifetime/rekey: 86400/46502
DPD sent/recv: 00000000/00000000
peer-id: Testing123

 

but .......................

How to match or group user based on ingested Entra object id  ?

if I define any object ID in the user group the EAP authentication will failed so i had to left it blank to make user connect success.

SAML Debug log
samld_send_common_reply [95]: Attr: 10, 41, 'username' 'test@limvuihan.com'
samld_send_common_reply [95]: Attr: 10, 61, 'FortigateGroups' 'abc'
samld_send_common_reply [95]: Attr: 10, 61, 'FortigateGroups' 'xzy'
samld_send_common_reply [95]: Attr: 10, 61, 'FortigateGroups' 'kjh'

 

config user group
edit "Azure_IPsec_IT"
set member "Azure_IPsec"
config match
edit 1
set server-name "Azure_IPsec"
set group-name "kjh"

config firewall policy
edit 223
set name "RemoteUser_Testing-1"
set srcintf "RemoteUser"
set dstintf "port999"
set action accept
set srcaddr "10.99.99.1"
set dstaddr "1.1.1.1"
set schedule "always"
set service "ALL_ICMP" "SSH" "HTTPS"
set utm-status enable
set logtraffic all
set groups "Azure_IPsec_IT"
next
end

Firewall policy wont work 

p/s
1.  Don't recommend local peer id as user/me has no time to manage it by each department/devices
2. Tried FSSO but there is limitation especial for those BYOD, since is not join domain so wont update netlogon to AD especial VVIP devices.
3. No TAC case is allow as no FortiClient license.
4. Really need interim solution before 7.4 EoE at March 2026. 
5. No IKEv1 ( This feature requires FortiClient 7.2.4 and FortiClient supports only using IKEv2)

6 replies

funkylicious
SuperUser
funkylicious
SuperUser
October 10, 2025

can you do a, show user saml ?

 

L.E. I would suggest the following:

- ensure that under config user saml you have for group 

i) either set group-name "group" , if you configured this and use this

ii) either set group-name "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups" , this would be confirmed if required from here

iii) in your case you might use FortigateGroups and require set group-name FortigateGroups ? you would get more clarity about what to configure when you do a debug and see what saml attributes you get.

- in the phase1 , unset authusrgrp and use/create groups based on SAML which you add in firewall rules at the source alongside the ipsec range

 

https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/727740/using-single-or-multiple-user-groups-for-user-authentication

 

"jack of all trades, master of none"
LVHan
LVHanAuthor
New Member
October 12, 2025

 

i) either set group-name "group" , if you configured this and use this

Yes had ensure that, SAML is working authentication is working, SAML response with correct Entra Object ID too.

 

ii) either set group-name "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups" , this would be confirmed if required from here


SAML did response back with the groups information

iii) in your case you might use FortigateGroups and require set group-name FortigateGroups ? you would get more clarity about what to configure when you do a debug and see what saml attributes you get.

 

 

Debug I run

diagnose debug application ike -1
diagnose debug application authd 60
diagnose debug application samld -1
diagnose debug application fnbamd -1
diagnose debug application eap_proxy -1
diagnose debug console timestamp enable
diagnose debug enable

- in the phase1 , unset authusrgrp and use/create groups based on SAML which you add in firewall rules at the source alongside the ipsec range

The authentication and SAML is work with unset authgroup but must define policy a firewall policy with the SAML user group 

but the user group cannot contain any Entra object ID else will hit to this error

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Error-EAP-failure-with-IPsec-Dial-Up-VPN-using/ta-p/363196

No matter how many user group I define with SSO and Entra ID object on firewall policy, user that success authenticated and success with IPSec will not category into user group, example SSLVPN

SSL VPN User GroupingFortiClient IPSEC
10.99.98.1, test@limvuihan.com - this my SSLVPN segment
type: fw, id: 0, duration: 961, idled: 0
expire: 28800, allow-idle: 28799
flag(80): sslvpn
server: Azure
packets: in 1288 out 1317, bytes: in 410818 out 135795
group_id: 2 4
group_name: Azure_All_User AZURE-IT		The only working is my FSSO identify me

10.99.99.1, LIMVUIHAN - this my IPSEC segment
type: fsso, id: 0, duration: 42, idled: 8
server: FSSO
packets: in 215 out 266, bytes: in 42001 out 73893
group_id: 28 24 33554794 33554588 33554440 33554435 33554786 33554732


As compare, the only different is the flag(80): sslvpn which IPSEC user doesnt flag as anything 



 

funkylicious
SuperUser
funkylicious
SuperUser
October 12, 2025

im confused.

you are not using Azure to auth users for both SSLVPN and IPsec ?

by your output, i would expect that a user group using Azure SAML Server and group AZURE-IT (maybe?) for SSLVPN and the same would/should work if you use the user group in the firewall rule for IPsec as source interface and in phase-1 unset/inherit from policy.

 

please do provide full output logs when you start a debug for both sslvpn and for ipsec, also the complete config for sslvpn and ipsec alongside , user saml / user groups and firewall policies.

feel free to mask any sensitive info.

"jack of all trades, master of none"
Terms & ConditionsAccessibility statement
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!