Skip to main content
bup
bup
New Member
January 23, 2026
Question

IPSec remote access from Linux with SAML SSO

  • January 23, 2026
  • 5 replies
  • 1257 views

Hi everyone,

 

I'm trying to set up remote access via IPSec to a FortiGate 60F. Since MS365 SSO is in use already for various services, this should be used also for VPN access. I've been able to successfully implement this and was able to connect from a Windows box with SSO and the FortiClient VPN-only version (7.4.3 hotfix 1.8758). EMS is not in use. However, I'm also looking for a solution for Linux, but each option that I see leads to a dead

 

  • Open-source IPsec clients like strongswan and libreswan don't appear to support SSO authentication (yet). I tried to add a separate user using static credentials for EAP login, but I also haven't found a way to use these tools with both a PSK and additional EAP authentication.
  • I was able to establish a connection with the regular Linux FortiClient, but it can't be used without an EMS except for a trial.
  • The FortiClient VPN-only version for Linux (7.4.3 build 1736) appears to only support SSL VPN, but not IPSec.
  • SSL VPN is obsolete and was removed from recent FortiOS, so resorting to this protocol is not really an option.

(When) will FortiClient VPN-only for Linux be updated to support IPSec VPN? Right now it appears to be Zombie software, as it only supports a protocol that is not available on updated FortiGates, so I assume the plan is to fully deprecate SSL VPN. Alternatively, can the regular FortiClient installation be put into Standalone mode, so that it can work without an EMS?

 

If there is no way with the FortiClient, did anybody succeed in configuring strongswan/libreswan to connect to a FortiGate with SSO or at least with a static user, when both PSK and EAP is in use?

 

Thanks!

5 replies

AEK
SuperUser
AEK
SuperUser
January 24, 2026

Hi Bup

The only solution I see at the moment is to create a Windows VM (with FCT-VPN) on your PC as a link between your Linux and the tunnel.

AEK
bup
bupAuthor
New Member
January 26, 2026

Hi AEK,

 

thanks for the response. While this certainly works for sporadic uses, it is of course only a fairly ugly workaround.

I'd really like to know whether Fortinet plans to release a Linux version of the VPN-only FortiClient with IPsec support in the near future. Given that they already have a VPN-only Linux version without IPsec and a fully-featured Linux version with IPsec, it appears that all the code is available already and would only require to be packed up into an installer...

Eduardoj
Eduardoj
Visitor III
March 14, 2026

Same problem here. I have some clients that need to autenticate from linux on IPsec VPN using SSO, but there is no native option for that.

RDMCH
RDMCH
New Member
May 18, 2026

Hi guys, did you find any solution except using a Windows VM ?

F
FarinaAhmed
Explorer
May 18, 2026

For Linux, FortiClient VPN-only currently seems to be the blocker because it does not provide the same IPsec SAML SSO capability as Windows FortiClient, so EMS/managed FortiClient may be required.

Terms & ConditionsAccessibility statement