Entra ID for SSL VPN and Outbound traffic ports

[EMFontana]

Hi people.  Im a little confuse for this configuration.

Actually, we're using Entra ID (Azure AD) SSO for ssl vpn and works great. 

In my fortinet, the saml config are on port 10043.

Here are the settings:

config user saml
edit "ssl-azure-saml"
set cert "Fortinet_Factory"
set entity-id "mypublicURL:10443/remote/saml/metadata"
set single-sign-on-url "mypublicURL:10443/remote/saml/login"
set single-logout-url "mypublicURL:10443/remote/saml/logout"
set idp-entity-id "https://windows.net/4b7xx12e-xxxxxxx7f9ef4xxx9a/"
set idp-single-sign-on-url https://login.microsoftonline.com/4b70212xxxxxxxa-a901-97xxxxxx9a/saml2"
set idp-single-logout-url "https://login.microsoftonline.com/4b7xxxcc32-4xxxxf4bda9a/saml2"
set idp-cert "REMOTE_Cert_2"
set user-name "username"
set group-name "group"

Now, we're setting up Entra SSO for outbound traffic, but using port 1003, according to thi document:

https://docs.fortinet.com/document/fortigate/6.4.14/administration-guide/33053

I´m lost..  Forti it doesn't let configure both services?  SSL VPN (port 10443) and Outbound traffic (port 1003) with Entra ID.

Thanks to all!

Eduardo.

[Shashwati]

hello, 

Please refer to the document for multiple Service Providers on a single Azure enterprise application for SAML authentication

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-single-Azure-Enterprise-Application-...

[Ade_23]

Hello,

You cannot use the same SSO instance for SSLVPN and outbound authentication on the same FortiGate. They would have to be two different instances.

[EMFontana]

Thanks, Ade_23...

But, inside the fortigate, how do you create anothes SSO instance?