Fortigate SSLVPN MFA using Okta

[hayli]

I am a novice for Forti products and I am trying to configure FortiGate SSLVPN MFA using Okta. Our current setup involves FortiAuthenticator configured as Radius for FortiGate and all user accounts are imported in FortiGate from Active Directory. These accounts are forwarding all VPN authentication queries to FortiAuthenticator, which prompts for FortiToken MFA on user's phone. We need to configure it so that Okta is used as IdP and users get their MFA prompts on Okta Verify app as we are already using Okta for all authentication.

I have created an Okta SAML app and configured it as IdP and have configured FortiGate as SP. I am now confused with how I should configure a test user to authenticate using SAML. I have checked various articles online but still a bit confused about this step. Most of the documents I have found are old I think and most of them have configured FortiGate SP using CLI as the option was not available using GUI back then I believe. Any suggestions are much appreciated!

[saneeshpv_FTNT]

Hi @hayli ,

Have you checked the article below. If not please have a look at the same and let me know if you have any additional queries.

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/499536/ssl-vpn-with-okta-as-... 

Best Regards,

San

[mle2802]

Hi @hayli,

I believe you need to create a group on FortiGate, point it to the Okta and use it for SSL VPN setting. Please refer to this document for more detail "https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/499536/ssl-vpn-with-okta-as-...

Regards,
Minh

[ndumaj]

Hi Hayli,

In this case the authentication is done Via FAC acting as radius server, so you need to configure Okta SAML on FAC.
Please review the following guide:
https://docs.fortinet.com/document/fortiauthenticator/6.5.0/cookbook/535422/saml-fsso-with-fortiauth...

BR