RA IPSec VPN + Cert Auth + SAML
Hello,
We have encountered an issue where FortiClient VPN Only clients are unable to connect, and the debug log shows the error "gw validation failed", whereas the full FortiClient EMS client works as expected.
At the moment, the following setup is working correctly only with the paid FortiClient EMS:
- Remote Access VPN (IPsec)
- Certificate-based authentication
- SAML authentication via Microsoft Entra ID (Azure AD)
phase1-interface:
config vpn ipsec phase1-interface
edit "RA-VPN-IPSEC"
set type dynamic
set interface "wan2"
set ike-version 2
set authmethod signature
set net-device disable
set mode-cfg enable
set ipv4-dns-server1 10.102.xxx.xxx
set ipv4-dns-server2 10.102.xxx.xxx
set ipv4-dns-server3 10.100.xxx.xxx
set proposal aes256-sha256
set dhgrp 14
set eap enable
set eap-identity send-request
set eap-cert-auth enable
set certificate "<our-worldwide-trusted-certificate>"
set peer "RA-IPSEC-VPN-CLIENT"
set ipv4-start-ip 10.102.251.10
set ipv4-end-ip 10.102.251.200
set ipv4-split-include "10.100.0.0-14"
set dpd-retryinterval 10
WAN-INTERFACE
config system interface
edit "wan2"
set vdom "root"
set ip xx.xxx.xxx.xxx 255.255.255.192
set allowaccess ping
set type physical
set alias "ISP 2"
set ike-saml-server "IPSEC-SAML-AZURE"
CERTIFCATE AUTH PARAMETERS
config user peer
edit "RA-IPSEC-VPN-CLIENT"
set ca "G_CA_Cert_2"
set cn-type FQDN
set mfa-mode subject-identity
set mfa-server "<fqdn.local-ldap-server>"
Solutions from How to fix 'gw validation failed'... - Fortinet Community not helped
