How to user grouping on Forticlient IPSec VPN with Azure Entra ID

[LVHan]

I really run out of idea on user grouping based on Azure Entra ID object ID.

I Follow the administration guide to prepare SSL VPN migrate to IPSec VPN with SAML

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/951346/saml-based-authentica...

On phase 1 configuration I face EAP credential error 

config vpn ipsec phase1-interface
    edit "FCT_SAML"
        set eap enable
        set eap-identity send-request
    next
end

Look for lots of tech doc only this work
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Error-EAP-failure-with-IPsec-Dial-Up-VPN-u...

Which mean I had to define the user Group without any Entra Object ID to make user authenticate success or firewall policy with the user group without Entra ID object.

config vpn ipsec phase1-interface
edit IPSec123
set authusrgrp "Azure_IPsec_Empty"
next
end

config user group
edit "Azure_IPsec_Empty"
set member "Azure_IPsec"
next
end

So no issue getting user connect with FortiClient IPSec

diagnose vpn ike gateway list

vd: root/0
name: IPSec123_0
version: 2
interface: port99 
addr: 192.168.20.1:4500 -> 8.8.8.8:14664
tun_id: 10.99.99.1/::10.0.0.4
remote_location: 0.0.0.0
network-id: 0
transport: UDP
virtual-interface-addr: 169.254.1.1 -> 169.254.1.1
created: 39628s ago
eap-user: test@limvuihan.com
2FA: no
peer-id: Testing123
peer-id-auth: yes
FortiClient UID:
assigned IPv4 address: 10.99.99.1/255.255.255.255
nat: me peer
pending-queue: 0
PPK: no
IKE SA: created 1/1 established 1/1 time 180/180/180 ms
IPsec SA: created 1/1 established 1/1 time 0/0/0 ms

id/spi: 148531
direction: responder
status: established 39628-39627s ago = 180ms
proposal: aes256-sha256
child: no
SK_ei:
SK_er:
SK_ai:
SK_ar:
PPK: no
message-id sent/recv: 0/53
QKD: no
lifetime/rekey: 86400/46502
DPD sent/recv: 00000000/00000000
peer-id: Testing123

but .......................

How to match or group user based on ingested Entra object id  ?

if I define any object ID in the user group the EAP authentication will failed so i had to left it blank to make user connect success.

SAML Debug log
samld_send_common_reply [95]: Attr: 10, 41, 'username' 'test@limvuihan.com'
samld_send_common_reply [95]: Attr: 10, 61, 'FortigateGroups' 'abc'
samld_send_common_reply [95]: Attr: 10, 61, 'FortigateGroups' 'xzy'
samld_send_common_reply [95]: Attr: 10, 61, 'FortigateGroups' 'kjh'

config user group
edit "Azure_IPsec_IT"
set member "Azure_IPsec"
config match
edit 1
set server-name "Azure_IPsec"
set group-name "kjh"

config firewall policy
edit 223
set name "RemoteUser_Testing-1"
set srcintf "RemoteUser"
set dstintf "port999"
set action accept
set srcaddr "10.99.99.1"
set dstaddr "1.1.1.1"
set schedule "always"
set service "ALL_ICMP" "SSH" "HTTPS"
set utm-status enable
set logtraffic all
set groups "Azure_IPsec_IT"
next
end

Firewall policy wont work 

p/s
1.  Don't recommend local peer id as user/me has no time to manage it by each department/devices
2. Tried FSSO but there is limitation especial for those BYOD, since is not join domain so wont update netlogon to AD especial VVIP devices.
3. No TAC case is allow as no FortiClient license.
4. Really need interim solution before 7.4 EoE at March 2026. 
5. No IKEv1 ( This feature requires FortiClient 7.2.4 and FortiClient supports only using IKEv2)

[funkylicious]

can you do a, show user saml ?

L.E. I would suggest the following:

- ensure that under config user saml you have for group 

i) either set group-name "group" , if you configured this and use this

ii) either set group-name "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups" , this would be confirmed if required from here

iii) in your case you might use FortigateGroups and require set group-name FortigateGroups ? you would get more clarity about what to configure when you do a debug and see what saml attributes you get.

- in the phase1 , unset authusrgrp and use/create groups based on SAML which you add in firewall rules at the source alongside the ipsec range

https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/727740/using-single-or-multi...

[LVHan]

i) either set group-name "group" , if you configured this and use this

Yes had ensure that, SAML is working authentication is working, SAML response with correct Entra Object ID too.

ii) either set group-name "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups" , this would be confirmed if required from here

SAML did response back with the groups information

iii) in your case you might use FortigateGroups and require set group-name FortigateGroups ? you would get more clarity about what to configure when you do a debug and see what saml attributes you get.

Debug I run

diagnose debug application ike -1
diagnose debug application authd 60
diagnose debug application samld -1
diagnose debug application fnbamd -1
diagnose debug application eap_proxy -1
diagnose debug console timestamp enable
diagnose debug enable

- in the phase1 , unset authusrgrp and use/create groups based on SAML which you add in firewall rules at the source alongside the ipsec range

The authentication and SAML is work with unset authgroup but must define policy a firewall policy with the SAML user group 

but the user group cannot contain any Entra object ID else will hit to this error

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Error-EAP-failure-with-IPsec-Dial-Up-VPN-u...

No matter how many user group I define with SSO and Entra ID object on firewall policy, user that success authenticated and success with IPSec will not category into user group, example SSLVPN

SSL VPN User Grouping	FortiClient IPSEC
10.99.98.1, test@limvuihan.com - this my SSLVPN segment type: fw, id: 0, duration: 961, idled: 0 expire: 28800, allow-idle: 28799 flag(80): sslvpn server: Azure packets: in 1288 out 1317, bytes: in 410818 out 135795 group_id: 2 4 group_name: Azure_All_User AZURE-IT	The only working is my FSSO identify me 10.99.99.1, LIMVUIHAN - this my IPSEC segment type: fsso, id: 0, duration: 42, idled: 8 server: FSSO packets: in 215 out 266, bytes: in 42001 out 73893 group_id: 28 24 33554794 33554588 33554440 33554435 33554786 33554732

As compare, the only different is the flag(80): sslvpn which IPSEC user doesnt flag as anything 



 

[funkylicious]

im confused.

you are not using Azure to auth users for both SSLVPN and IPsec ?

by your output, i would expect that a user group using Azure SAML Server and group AZURE-IT (maybe?) for SSLVPN and the same would/should work if you use the user group in the firewall rule for IPsec as source interface and in phase-1 unset/inherit from policy.

please do provide full output logs when you start a debug for both sslvpn and for ipsec, also the complete config for sslvpn and ipsec alongside , user saml / user groups and firewall policies.

feel free to mask any sensitive info.

[LVHan]

Both are  use Azure SAML and no issue on authentication. 

	SSLVPN	IPSEC
User Grouping	firewall able match username with the configured user group (contain Entra object ID) with the SAML responsed Entra Object ID	the SAML return the Entra Object ID but firewall doesnt match the username with the configured user group (contain Entra object ID)
Authentication	For SSLVPN, firewall able authenticate user with multiple user group and different Entra Object ID	Unable authenticate user if there is Entra Object ID configure, else will prompt EAP error. So  to make user success authenticate the work around is to accept any Entra Object ID

[funkylicious]

debug logs for ipsec saml auth would be nice to see either way.