IPSEC ikeV2 Dialup VPN with Okta

Maybe post your config or tell us if it's Radius or SAML.

sounds like you are facing problems with dialup ipsec using okta saml sso where the authentication + 2FA is successful but the vpn is not connecting. This is often an indication that the ipsec tunnel negotiation is not successful or authentication timeout is happening too early.

Please start off by increasing the remoteauthtimeout value on FortiGate: https://docs.fortinet.com/document/fortiauthenticator/6.5.0/cookbook/306162/increasing-remote-authentication-timeout-using-fortigate-cli 

To check ike negotiation, kindly run these commands in the fortigate to debug it:

# diag deb console time en

diag vpn ike log filter name <ipsec-name>   -> rem-addr4 for the public source-ip of your endpoint that you are connecting with

diag deb app ike -1

diag deb enable

-> reproduce issue

To disable the debug:

# diag deb disable

diag deb reset 

>> Please ensure the phase1 and phase2 selectors on FortiClient and FortiGate are configured the same. It's also worth deleting the existing vpn profile on FortiClient and recreating it.