Can two or more AzureAD-linked SSL-VPN be set up in one Fortigate?
We are currently using FortiGate's SSL-VPN with Azure AD accounts for authentication. We have been asked to configure access control on a per-user or per-department basis in this environment.
I think to add a separate entry for "FortiGate SSL VPN" (e.g., named FortigateSSLVPN2) in the list of Managed SaaS apps available in Azure AD's gallery. This would allow us to configure access rights specifically for this instance, separate from the currently used FortiGate-SSLVPN. Is it possible to configure multiple instances of FortiGate with Single Sign-On (SSO) from the same Azure AD?
However, I can't log in with Azure AD SSO with Groups.
The error message is "Message: AADSTS50105: Your administrator has configured the application FortiGate SSL VPN ('XXXXX') to block users unless they are specifically granted ('assigned') access to the application."
Are the settings different between FortiOS 6.4 and 7.4？
Yes, it is possible to configure multiple instances of FortiGate with Single Sign-On (SSO) from the same Azure AD.
To do this, you would need to create a new instance of the FortiGate SSL-VPN and link it to a new Managed SaaS app in the Azure AD gallery, as you suggested. You can then configure access rights specifically for this new instance.
Once you have set up the new instance and SaaS app in Azure AD, you can configure the FortiGate to use SSO for authentication. This involves configuring the FortiGate to use Azure AD as the authentication server, and specifying the SaaS app ID for the new FortiGate SSL-VPN instance.
You can find detailed instructions on how to configure FortiGate SSL-VPN with Azure AD SSO in the Fortinet documentation.
n order to configure FortiGate SSL-VPN with Azure AD SSO for multiple instances, you would follow these general steps:
1. Create a new FortiGate SSL-VPN instance on your FortiGate.
2. Go to the Azure portal and create a new SaaS app for the new FortiGate SSL-VPN instance. You can do this by going to the "Enterprise applications" section of the Azure portal and clicking "New application".
3. Configure the SaaS app settings for the new FortiGate SSL-VPN instance, such as the name, logo, and user assignment settings.
4. Once the SaaS app is set up, go to the "Properties" section of the app and copy the "Application (client) ID" value.
5. In the FortiGate, go to the "User & Device" > "Authentication" > "LDAP Servers" page and create a new LDAP server for Azure AD.
6. In the LDAP server settings, configure the "Server IP" field to point to the Azure AD domain name (e.g. contoso.onmicrosoft.com), and configure the "Bind Type" to "Regular LDAP".
7. In the LDAP server settings, configure the "User DN" and "Password" fields to use an Azure AD service account that has read access to the Azure AD directory.
8. In the LDAP server settings, configure the "Group Filter" and "Group Member Attribute" fields to match the Azure AD group that you want to use for SSL-VPN access control.
9. In the FortiGate, go to the "User & Device" > "Authentication" > "SSO" page and enable SSO.
10. In the SSO settings, configure the "Auth Server" to use the Azure AD LDAP server you created, and configure the "SaaS App ID" to match the "Application (client) ID" value you copied from the Azure portal.
11. Save the SSO settings and test the configuration by logging in to the new FortiGate SSL-VPN instance using an Azure AD account that is a member of the specified group.
You can repeat these steps to create additional FortiGate SSL-VPN instances and link them to separate SaaS apps in Azure AD, allowing you to configure access control on a per-user or per-department basis for each instance.
Yes, it is possible to configure multiple instances of the same Fortigate from the same AzureAD. However, it's important to ensure that the configurations for each instance are properly set up to avoid any conflicts.
Regarding your question about which instance takes precedence when a user connects to the VPN, it will depend on the configuration set up for each instance. If both instances have the same user configured with the same permissions, then it's possible that the instance that the user connects to first will take precedence. However, if one instance has priority settings configured, then that instance may take precedence over the other. It's important to consult the documentation for each instance to determine how the configurations are set up and how user connections are prioritized.
After creating another realm, setting Saml, and connecting from a VPN client, the following screen is displayed and authentication is not displayed. If you have experienced a similar issue in the past, could you please let me know the solution?
Thank you for sharing your experience with the Fortinet firewall. It seems that you encountered some challenges during the verification process. You mentioned that you don't have Azure AD Premier licenses, which prevents your Fortigate from identifying the group ID on Azure AD.
Additionally, you mentioned creating multiple instances, but encountered an error when setting the SSO identifier on the instance. The error could not be resolved and the verification period has expired.
To work around these issues, you chose to authenticate with a single instance of Azure AD and set multiple realms.
If you would like to explore alternative solutions, please provide more details or specific requirements, and I will try my best to assist you.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.