IPSEC VPN Dial Up with SAML and FIDO2 support

Forum|Forum|7 months ago
December 17, 2025
2 replies
610 views

Hi, I'm trying to configure an IPSEC VPN dial-up with saml and fido2 (yubikey) using the External Browser as User-agent for SAML Login option - it's not working. It works for SSLVPN, but not for IPSEC. The client version is 7.2.12. Could it be that it's not working? It works without problems using credentials via Microsoft Authenticator with the External Browser as User-agent for SAML Login option disabled, but when I enable it and use the FIDO2 key method, the browser displays a message that I've logged in, but the tunnel doesn't establish. The tunnel is configured based on ike2 with the networkid parameter. Has anyone else encountered this problem?

Regards

FortiClient

Best answer by ezhupa

Hello,
According to official DOC:
https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/951346/saml-based-authentication-for-forticlient-remote-access-dialup-ipsec-vpn-clients
"
Dialup IPsec VPN with SAML using an external browser for authentication is supported starting from FortiOS 7.6.1, FortiClient (Windows) and (macOS) 7.2.5 and 7.4.1 and FortiClient (Linux) 7.4.3.
"

Hope this helps!

ezhupaAnswer

Staff

Hello,
According to official DOC:
https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/951346/saml-based-authentication-for-forticlient-remote-access-dialup-ipsec-vpn-clients
"
Dialup IPsec VPN with SAML using an external browser for authentication is supported starting from FortiOS 7.6.1, FortiClient (Windows) and (macOS) 7.2.5 and 7.4.1 and FortiClient (Linux) 7.4.3.
"

Hope this helps!

Andrzej_PLAuthor

Visitor III

Thanks for the info - today I will upgrade to the mature 7.6.5 version

Sign up

Login with SSO

Login to the community

Login with SSO