Technical Tip: Prerequisites when implementing IPsec VPN SAML-based authentication

[Nivedha]

Description	This article provides prerequisites for configuring IPsec VPN SAML-based authentication.
Scope	FortiGate v7.2+, EMS v7.2+, FortiClient v7.2+, FortiAuthenticator v6.4+.
Solution	Similar to SSL VPN SAML-based authentication, FortiOS 7.2 onwards IPSEC VPN also supports SAML-based authentication. The full configuration for the same is listed in IPsec VPN SAML-based authentication and SAML-based authentication for FortiClient remote access dialup IPsec VPN clients Things to consider for this configuration to work: EMS has to be added to the Security Fabric on FortiGate.Refer to: Add EMS to Security Fabric  CLI commands for the same: config endpoint-control fctems     edit <name>         set server <IP of the server on which EMS is installed>         set serial-number <S/N number of the EMS (optional)>         set https-port <Port used by EMS (listed under System Settings on EMS)>         set admin-username <admin username>     end FortiClient should be installed in a non-domain joined device or if domain joined, the device should not be part of the network that FortiGate is on. This is because the device should be on a remote network to connect to IPSec VPN as a remote device. This configuration is only possible with FortiClient as the remote dialup client and not for other devices. When using FortiAuthenticator as the IdP, refer to FortiAuthenticator as an IdP to configure SAML IdP on FortiAuthenticator Use the test Single Sign On facility in Azure to check if the Single Sign-on works as expected - Test Single Sign on  Configure the tunnel with IKEv2 instead of IKEv1. FortiGate does not support SAML-based authentication for IPsec VPN with IKEv1. SAML authentication requires an interactive login process (browser-based authentication flow), which is not supported in IKEv1.