Fortigate 7.4.7 with IPSec SAML and Certificates

[Hybridesque]

Afternoon all, 

I have a Fortigate 91G running on 7.4.7 presently as it's still running SSO SSL VPN, linked to EntraID for SAML.

With the SSL VPN being deprecated on later versions for this unit, we are trying to migrate to dial-in IPSec VPN but am being given the restriction of using certificates instead of the PSK to implement this.

So, is it possible to implement a dial-in IPSec that links to EntraID for SAML, but doesn't require the PSK, and allows me to use a certificate instead?

I have so far managed to get the Forticlient to connect and you see the Phase1/Phase2 tunnels on Status/Networks/IPSec but no traffic fails to flow over it.  Forticlient is stuck during the connection phase as well, not displaying the counter and details like it would when connected successfully.

Feels like there's a disconnect between the PKI configured and SAML authentication systems, which may be the issue.

Sanitised Phase 1 configuration in use

---------------------------------

config vpn ipsec phase1-interface

edit "IPSec_SAML"

set type dynamic

set interface "wan1"

set ike-version 2

set authmethod signature

set peertype peergrp

set net-device disable

set mode-cfg enable

set proposal aes256-sha256

set dpd on-idle

set dhgrp 20

set certificate "IPSecCert"

set peergrp "IPSecGrp"

set ipv4-start-ip 10.214.156.1

set ipv4-end-ip 10.214.156.250

set ipv4-split-include "Split Networks"

set save-password enable

set dpd-retryinterval 60

set ipv4-dns-server1 10.0.1.1

set ipv4-dns-server2 10.0.1.2

set internal-domain-list "xyz.local"

next

end

[ForgetItNet]

Ignore this (I can't find the delete option) but it DOES work with the new version of the VPN only program 7.4.3 hotfix 1.8758, it was a setting that I hadn't changed since trying to fix it last time.