| Description |
This article describes an issue when a user tries to connect to a Dial-Up VPN tunnel using SAML authentication, and the FortiClient shows a blank screen after authenticating on the SAML login page (Azure in this example).
|
| Scope | FortiOS v7.2.0 and above, FortiClient v7.2.4 and above. |
| Solution |
This issue occurred due to SAML URLs misconfiguration. To configure a Dial-Up VPN tunnel using SAML authentication, 'auth-ike-saml-port' must be specified in the CLI. By default, the port is set to 1001, and in this example, it is set to port 10443.
config system global set auth-ike-saml-port 10443 <-- default port = 1001. end
However, the SAML URLs did not include port 10443 on both FortiGate and Azure.
To resolve the issue, include port 10443 in the URLs on both FortiGate and Azure sides. After modifying the URLs, it is necessary to download the certificate from Azure again and re-import it to the FortiGate.
Related article: Technical Tip: How to configure Microsoft Entra ID... - Fortinet Community |
