FortiClientVPN Dialup IPsec SAML EntraID within in the same network

[fabs]

Hello all,

We use IPsec Dialup VPN with SAML via EntraID. When I try to connect via IPsec VPN inside same network in which the Fortigate is located, I get the error "ERR_EMPTY_RESPONSE" when calling SAML
Is this an expected behavior? If not, what could be the issue and how can I fix it?
If I'm connected outside of my Fortigate, all is working fine.

Similarly, we also have an SSL VPN via SAML EntraID and the login works within the same network.

Also the Single Sign-On settings for the IPsec SAML looks similar to the SSL SAML.

Fortigate: v7.6.3 build3510
FortiClientVPN 7.4.2.1737 / 7.4.3

Best Regards

fabs

[funkylicious]

hi,

maybe something in here could help with your issue.

also, i assume the ike-saml-port used for IPsec is different from the port used in SSLVPN?

[fabs]

@funkylicious 
Thanks for your reply. This thread you mentioned was original from me. But this issue related to something other.

Yes SSL SAML and IPsec SAML has different ports.

[fabs]

Btw if I use my iPhone via WiFi within the same network with latest FortiClientVPN, I've got the error prompt "The network connection was los."

[funkylicious]

oh, my bad.

have you tried doing a debug of the traffic, saml and ike for the traffic ?

[fabs]

The FQDN resolves to the WAN IP (public ip) from the ISP.
From outside and from inside network resolves the FQDN to this IP address.
The same IP that is also entered under Interfaces -> WAN.

I have exactly the same problem at my other site (branch office).

Here is the debug:
192.168.10.142 is the local ip address, xx.xx.xx.xx is the public ip address.

FGT01 # diag debug reset

FGT01 # diag vpn ike log filter name "xxxxxx IPsec"

FGT01 # diag debug console timestamp enable

FGT01 # diag debug app authd 60
Debug messages will be on for 30 minutes.

FGT01 # diag debug app fnbamd -1
Debug messages will be on for 30 minutes.

FGT01 # diag debug app saml -1

FGT01 # diag debug app ike -1
Debug messages will be on for 30 minutes.

FGT01 # diag debug application eap_proxy -1
Debug messages will be on for 30 minutes.

FGT01 # diag debug enable

FGT01 # 2025-06-12 14:29:24 1749731364.917972: 2025-06-12 14:29:24 eap_comm_client_read:711, type:2, size:928

2025-06-12 14:29:24 [2396] handle_req-Rcvd auth_cert req id=8741, len=4076, opt=0
2025-06-12 14:29:24 [1189] __cert_auth_ctx_init-req_id=8741, opt=0
2025-06-12 14:29:24 [106] __cert_chg_st- 'Init'
2025-06-12 14:29:24 [205] fnbamd_cert_load_certs_from_req-2 cert(s) in req.
2025-06-12 14:29:24 [842] __cert_init-req_id=8741
2025-06-12 14:29:24 [891] __cert_build_chain-req_id=8741
2025-06-12 14:29:24 [323] fnbamd_chain_build-Chain discovery, opt 0x13, cur total 1
2025-06-12 14:29:24 [341] fnbamd_chain_build-Following depth 0
2025-06-12 14:29:24 [370] fnbamd_chain_build-Extend chain by system trust store. (no luck)
2025-06-12 14:29:24 [424] fnbamd_chain_build-Extend chain by peer-provided certs. (good)
2025-06-12 14:29:24 [341] fnbamd_chain_build-Following depth 1
2025-06-12 14:29:24 [376] fnbamd_chain_build-Extend chain by system trust store. (good: 'GlobalSign_Root_CA_-_R3')
2025-06-12 14:29:24 [341] fnbamd_chain_build-Following depth 2
2025-06-12 14:29:24 [355] fnbamd_chain_build-Self-sign detected.
2025-06-12 14:29:24 [102] __cert_chg_st- 'Init' -> 'Validation'
2025-06-12 14:29:24 [1013] __cert_verify-req_id=8741
2025-06-12 14:29:24 [1014] __cert_verify-Chain is complete.
2025-06-12 14:29:24 [540] fnbamd_cert_verify-Chain number:3
2025-06-12 14:29:24 [554] fnbamd_cert_verify-Following cert chain depth 0
2025-06-12 14:29:24 [554] fnbamd_cert_verify-Following cert chain depth 1
2025-06-12 14:29:24 [629] fnbamd_cert_verify-Issuer found: GlobalSign_Root_CA_-_R3 (SSL_DPI opt 1)
2025-06-12 14:29:24 [554] fnbamd_cert_verify-Following cert chain depth 2
2025-06-12 14:29:24 [734] fnbamd_cert_check_group_list-Will match any!
2025-06-12 14:29:24 [199] __get_default_ocsp_ctx-def_ocsp_ctx=(nil), no_ocsp_query=0, ocsp_enabled=0
2025-06-12 14:29:24 [1079] __cert_verify_do_next-req_id=8741
2025-06-12 14:29:24 [102] __cert_chg_st- 'Validation' -> 'Done'
2025-06-12 14:29:24 [1126] __cert_done-req_id=8741
2025-06-12 14:29:24 [1548] fnbamd_auth_session_done-Session done, id=8741
2025-06-12 14:29:24 [1172] __fnbamd_cert_auth_run-Exit, req_id=8741
2025-06-12 14:29:24 [1591] create_auth_cert_session-fnbamd_cert_auth_init returns 0, id=8741
2025-06-12 14:29:24 [1504] auth_cert_success-id=8741
2025-06-12 14:29:24 [1284] fnbamd_cert_auth_copy_cert_status-req_id=8741
2025-06-12 14:29:24 [950] fnbamd_cert_check_matched_groups-checking group ANY
2025-06-12 14:29:24 [961] fnbamd_cert_check_matched_groups-matched
2025-06-12 14:29:24 [1323] fnbamd_cert_auth_copy_cert_status-Leaf cert status is unchecked.
2025-06-12 14:29:24 [1340] fnbamd_cert_auth_copy_cert_status-Issuer of cert depth 0 is not detected in CMDB.
2025-06-12 14:29:24 [1411] fnbamd_cert_auth_copy_cert_status-Cert st 2c0, req_id=8741
2025-06-12 14:29:24 [239] fnbamd_comm_send_result-Sending result 0 (nid 672) for req 8741, len=2602
2025-06-12 14:29:24 [1379] destroy_auth_cert_session-id=8741
2025-06-12 14:29:24 [1256] fnbamd_cert_auth_uninit-req_id=8741
2025-06-12 14:29:24 [1887] fnbamd_ldaps_destroy-
2025-06-12 14:29:24 [1433] fnbamd_rads_destroy-
2025-06-12 12:29:26.234290 ike :config update start
2025-06-12 12:29:26.234520 ike :ike_embryonic_conn_limit = 1000
2025-06-12 12:29:26.234908 ike :ikecrypt DH multi-process disabled
2025-06-12 12:29:26.235281 ike V=root:0: sync=no FGCP:disabled role:master, FGSP:disabled id:0 slave-add-routes:disabled
2025-06-12 12:29:26.247885 ike V=root:0:xxxxxx IPsec: local-addr xx.xx.xx.xx
2025-06-12 12:29:26.247946 ike V=root:0:xxxxxx IPsec: oif 7, vrf 0
2025-06-12 12:29:26.271914 ike V=root:0: policy 23 disabled, ignoring
2025-06-12 12:29:26.289605 ike V=root:0: policy 53 disabled, ignoring
2025-06-12 12:29:26.314764 ike :config clean start 17
2025-06-12 12:29:26.314966 ike :config clean done 17
2025-06-12 12:29:26.315009 ike :config update done
2025-06-12 14:29:26 authd_session_create_new:531 Session created, vfid 0, vrf 0, src 192.168.10.142:35966, dst xx.xx.xx.xx:16640, flag 10208000
2025-06-12 14:29:26 [authd_http_accept_session:1088]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:26 [authd_http_change_state:2817]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:26 authd_http: change state from 0 to 1
2025-06-12 14:29:26 [authd_http_accepting:1167]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:26 [authd_http_change_state:2817]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:26 authd_http: change state from 1 to 2
2025-06-12 14:29:26 [authd_http_connect:1691]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:26 authd_epoll_work: timeout 47480
2025-06-12 14:29:26 [authd_http_read:957]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:26 [authd_http_connect:1691]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:26 [authd_http_change_state:2817]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:26 authd_http: change state from 2 to 6
2025-06-12 14:29:26 [authd_http_done:2785]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:26 authd_epoll_work: timeout 47470
2025-06-12 12:29:27.254293 ike V=root:0: cache rebuild start
2025-06-12 12:29:27.254424 ike V=root:0:xxxxxx IPsec: cached as dynamic
2025-06-12 12:29:27.254466 ike V=root:0: cache rebuild done
2025-06-12 14:29:28 authd_session_create_new:531 Session created, vfid 0, vrf 0, src 192.168.10.142:35970, dst xx.xx.xx.xx:16640, flag 10208000
2025-06-12 14:29:28 [authd_http_accept_session:1088]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 [authd_http_change_state:2817]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 authd_http: change state from 0 to 1
2025-06-12 14:29:28 [authd_http_accepting:1167]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 [authd_http_change_state:2817]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 authd_http: change state from 1 to 2
2025-06-12 14:29:28 [authd_http_connect:1691]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 [authd_http_set_server_cert:791]: found xxxxxx SSL VPN for xxxxxx.xxxxxx.com
2025-06-12 14:29:28 authd_epoll_work: timeout 45820
2025-06-12 14:29:28 authd_session_create_new:531 Session created, vfid 0, vrf 0, src 192.168.10.142:35971, dst xx.xx.xx.xx:16640, flag 10208000
2025-06-12 14:29:28 [authd_http_accept_session:1088]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 [authd_http_change_state:2817]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 authd_http: change state from 0 to 1
2025-06-12 14:29:28 [authd_http_accepting:1167]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 [authd_http_change_state:2817]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 authd_http: change state from 1 to 2
2025-06-12 14:29:28 [authd_http_connect:1691]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 [authd_http_set_server_cert:791]: found xxxxxx SSL VPN for xxxxxx.xxxxxx.com
2025-06-12 14:29:28 authd_epoll_work: timeout 45800
2025-06-12 14:29:28 [authd_http_read:957]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 [authd_http_connect:1691]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 [authd_http_change_state:2817]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 authd_http: change state from 2 to 3
2025-06-12 14:29:28 [authd_http_wait_req:2296]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 [authd_http_read_http_message:498]: called
2025-06-12 14:29:28 [authd_http_is_full_http_message:446]: called
2025-06-12 14:29:28 [authd_http_on_method_post:5401]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 [authd_local_saml_auth:5842]: SAML login with UID '141FF55D805E4F588D748F062F9CDF6F'.
2025-06-12 14:29:28 [authd_local_saml_auth:5855]: No SAML method found.
2025-06-12 14:29:28 [authd_http_change_state:2817]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 authd_http: change state from 3 to 5
2025-06-12 14:29:28 [authd_http_disconnect:2740]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 [authd_http_change_state:2817]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 authd_http: change state from 5 to 6
2025-06-12 14:29:28 [authd_http_done:2785]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 authd_epoll_work: timeout 45800
2025-06-12 14:29:28 [authd_http_read:957]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 [authd_http_connect:1691]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 [authd_http_change_state:2817]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 authd_http: change state from 2 to 3
2025-06-12 14:29:28 [authd_http_wait_req:2296]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:28 [authd_http_read_http_message:498]: called
2025-06-12 14:29:28 authd_epoll_work: timeout 45800
2025-06-12 12:29:28.429241 ike V=root:0: comes 44.221.5.255:500->xx.xx.xx.xx:500,ifindex=7,vrf=0,len=76....
2025-06-12 12:29:28.429347 ike V=root:0: IKEv2 exchange=INFORMATIONAL id=7d6f901aa3338058/e863a5fb486d5e46:00000233 len=76
2025-06-12 12:29:28.429380 ike 0: in 7D6F901AA3338058E863A5FB486D5E462E202508000002330000004C0000003004CC5CADD1ECE471399340F98BB535FC51A2695738952ADE0380378A0DF6F406614E415BC912294D5BE65564
2025-06-12 14:29:30 [authd_http_read:957]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:30 [authd_http_wait_req:2296]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:30 [authd_http_read_http_message:498]: called
2025-06-12 14:29:30 [authd_http_change_state:2817]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:30 authd_http: change state from 3 to 6
2025-06-12 14:29:30 [authd_http_done:2785]: src [192.168.10.142] flag 10208000
2025-06-12 14:29:30 authd_epoll_work: timeout 43630
2025-06-12 12:29:30.316783 ike V=root:0: comes 34.199.9.216:500->xx.xx.xx.xx:500,ifindex=7,vrf=0,len=76....
2025-06-12 12:29:30.316854 ike V=root:0: IKEv2 exchange=INFORMATIONAL id=273a81391cfaae09/8992930b00d8e5dd:0000022a len=76
2025-06-12 12:29:30.316882 ike 0: in 273A81391CFAAE098992930B00D8E5DD2E2025080000022A0000004C00000030B5A24AB23802B42430EA257D145C62F9506F105D0CFB4D15F303AC77F941C2BC67ADAC7C096719DAFDAD5314
2025-06-12 14:29:31 authd_timer_run: 3 expired
2025-06-12 14:29:31 authd_epoll_work: timeout 60000
2025-06-12 14:29:31 authd_timer_run: 3 expired
2025-06-12 14:29:31 authd_epoll_work: timeout 60000
2025-06-12 14:29:31 authd_timer_run: 3 expired
2025-06-12 14:29:31 authd_epoll_work: timeout 60000
2025-06-12 14:29:31 authd_timer_run: 3 expired
2025-06-12 14:29:31 authd_epoll_work: timeout 60000
2025-06-12 12:29:32.054349 ike :shrank heap by 159744 bytes
2025-06-12 12:29:38.429526 ike V=root:0: comes 44.221.5.255:500->xx.xx.xx.xx:500,ifindex=7,vrf=0,len=76....
2025-06-12 12:29:38.429641 ike V=root:0: IKEv2 exchange=INFORMATIONAL id=7d6f901aa3338058/e863a5fb486d5e46:00000234 len=76
2025-06-12 12:29:38.429674 ike 0: in 7D6F901AA3338058E863A5FB486D5E462E202508000002340000004C000000303DA29308BB45D1FACF11234BCD364DA1A0F9571353819D1F3A566C03DAD219B8156D3A491E6B5217EF2092C5