Can two or more AzureAD-linked SSL-VPN be set up in one Fortigate?

[Hiroki]

We are currently using FortiGate's SSL-VPN with Azure AD accounts for authentication.
We have been asked to configure access control on a per-user or per-department basis in this environment.

I think to add a separate entry for "FortiGate SSL VPN" (e.g., named FortigateSSLVPN2) in the list of Managed SaaS apps available in Azure AD's gallery. This would allow us to configure access rights specifically for this instance, separate from the currently used FortiGate-SSLVPN.
Is it possible to configure multiple instances of FortiGate with Single Sign-On (SSO) from the same Azure AD?

The　FortiOS version is 7.2.

Thank you in advance.

[Toshi_Esumi]

Your objective is to set up multiple SSL VPN user groups based on groups on Azure AD, like Group1, Group2, ... Right?

Then you just need to create different groups under "config user group" with the same SAML server name but different group-names copied from the AD's group's object-id.

You don't need different instances of SAML servers.

That's what we did for one of customers with FG100F.

Toshi

[Hiroki]

Thank you for the reply.

I read this URLs TIPs and I added the saml configuration on the our fortigate.

Technical Tip: Configure group based policies for ... - Fortinet Community

However, I can't log in with Azure AD SSO with Groups.

The error message is "Message: AADSTS50105: Your administrator has configured the application FortiGate SSL VPN ('XXXXX') to block users unless they are specifically granted ('assigned') access to the application."

Are the settings different between FortiOS 6.4 and 7.4？

[Toshi_Esumi]

First only thing you need to change on the FortiGate side is 3) and 4) in the doc since you already have one working.

And the error seems to be on the Azure AD side by the way the enterprise app was created. So doesn't seem to be anything to do with FortiGate versions.

I never touched Azure AD side since it's set up by our customer so I don't know exactly where you should look at at Azure AD.

Wait for somebody else to chime in.

Toshi

[Faiza_Emam_Delhi]

Yes, it is possible to configure multiple instances of FortiGate with Single Sign-On (SSO) from the same Azure AD.

To do this, you would need to create a new instance of the FortiGate SSL-VPN and link it to a new Managed SaaS app in the Azure AD gallery, as you suggested. You can then configure access rights specifically for this new instance.

Once you have set up the new instance and SaaS app in Azure AD, you can configure the FortiGate to use SSO for authentication. This involves configuring the FortiGate to use Azure AD as the authentication server, and specifying the SaaS app ID for the new FortiGate SSL-VPN instance.

You can find detailed instructions on how to configure FortiGate SSL-VPN with Azure AD SSO in the Fortinet documentation.

n order to configure FortiGate SSL-VPN with Azure AD SSO for multiple instances, you would follow these general steps:

1. Create a new FortiGate SSL-VPN instance on your FortiGate.

2. Go to the Azure portal and create a new SaaS app for the new FortiGate SSL-VPN instance. You can do this by going to the "Enterprise applications" section of the Azure portal and clicking "New application".

3. Configure the SaaS app settings for the new FortiGate SSL-VPN instance, such as the name, logo, and user assignment settings.

4. Once the SaaS app is set up, go to the "Properties" section of the app and copy the "Application (client) ID" value.

5. In the FortiGate, go to the "User & Device" > "Authentication" > "LDAP Servers" page and create a new LDAP server for Azure AD.

6. In the LDAP server settings, configure the "Server IP" field to point to the Azure AD domain name (e.g. contoso.onmicrosoft.com), and configure the "Bind Type" to "Regular LDAP".

7. In the LDAP server settings, configure the "User DN" and "Password" fields to use an Azure AD service account that has read access to the Azure AD directory.

8. In the LDAP server settings, configure the "Group Filter" and "Group Member Attribute" fields to match the Azure AD group that you want to use for SSL-VPN access control.

9. In the FortiGate, go to the "User & Device" > "Authentication" > "SSO" page and enable SSO.

10. In the SSO settings, configure the "Auth Server" to use the Azure AD LDAP server you created, and configure the "SaaS App ID" to match the "Application (client) ID" value you copied from the Azure portal.

11. Save the SSO settings and test the configuration by logging in to the new FortiGate SSL-VPN instance using an Azure AD account that is a member of the specified group.

You can repeat these steps to create additional FortiGate SSL-VPN instances and link them to separate SaaS apps in Azure AD, allowing you to configure access control on a per-user or per-department basis for each instance.

[Hiroki]

Thank you for the reply.

Is it possible to configure multiple instances of the same Fortigate from the same AzureAD?　

However, if that configuration is carried out, I have a question. if both instances have the same user, which instance takes precedence when that user connects to the VPN?

Thank you in advance.

[Faiza_Emam_Delhi]

Yes, it is possible to configure multiple instances of the same Fortigate from the same AzureAD. However, it's important to ensure that the configurations for each instance are properly set up to avoid any conflicts.

Regarding your question about which instance takes precedence when a user connects to the VPN, it will depend on the configuration set up for each instance. If both instances have the same user configured with the same permissions, then it's possible that the instance that the user connects to first will take precedence. However, if one instance has priority settings configured, then that instance may take precedence over the other. It's important to consult the documentation for each instance to determine how the configurations are set up and how user connections are prioritized.

[Hiroki]

Thank you for the reply.

We trid  creating multiple instances.

After creating another realm, setting Saml, and connecting from a VPN client, the following screen is displayed and authentication is not displayed.
If you have experienced a similar issue in the past, could you please let me know the solution?

[Hiroki]

Thank you for all reply.

I conducted the verification at Fortigate and understood the following.

.Group identification: We don't have Azure AD Premire lisences, This case Our Fortigate cannot identifier the group ID on AzureAD.

.Multiple instances: I created multi-instance, but the SSO identifier I set on the instance must be unique. So I set the realm to Fortigate, but I got an error that access is denied.

The error could not be resolved and the verification period has expired.

We avoided operation by authenticating with a single instance of AzureAD and setting multiple realms.

If you have different solution, please let me know.

[Faiza_Emam_Delhi]

@Hiroki 

Thank you for sharing your experience with the Fortinet firewall. It seems that you encountered some challenges during the verification process. You mentioned that you don't have Azure AD Premier licenses, which prevents your Fortigate from identifying the group ID on Azure AD.

Additionally, you mentioned creating multiple instances, but encountered an error when setting the SSO identifier on the instance. The error could not be resolved and the verification period has expired.

To work around these issues, you chose to authenticate with a single instance of Azure AD and set multiple realms.

If you would like to explore alternative solutions, please provide more details or specific requirements, and I will try my best to assist you.